CVE-2026-104122

MediumCVSS 6.8/10Last modified Oct 19, 2026

Description

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	Ukr-To-Lat	<= 1.3.5

References

https://wpscan.com/vulnerability/01abcbf8-d256-49b9-b660-38c50506c441/

Timeline

Published: Oct 17, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1041237.3A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functiona CVE-2026-1041266.0JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible CVE-2026-1041337.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/c CVE-2026-1041346.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons CVE-2026-1041356.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymen CVE-2026-1041366.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall bran CVE-2026-1041376.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search bran CVE-2026-1041386.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_downloa CVE-2026-1041396.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt CVE-2026-1041406.1QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders fea CVE-2026-1041418.7DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names,CVE-2026-1041428.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min,