CVE-2026-110651

MediumCVSS 6.8/10Last modified Oct 21, 2026

Description

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1106524.0ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid en CVE-2026-1106539.1The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass CVE-2026-1106546.1libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supp CVE-2026-1106553.1miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPn CVE-2026-1106563.1miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handli CVE-2026-1106573.3Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write f CVE-2026-1106585.3Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attac CVE-2026-1106595.5ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to cra CVE-2026-110669.6Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform CVE-2026-1106603.3vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader re CVE-2026-1106613.3CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by CVE-2026-1106646.4The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' param