CVE-2026-11590

HighCVSS 8.6/10Last modified Jun 30, 2026

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 30, 2026
Last modified
Jun 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-115914.4The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, aCVE-2026-115924.3The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerabCVE-2026-1159296.8MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has tCVE-2026-1159319.9Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functiCVE-2026-1159329.6When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that thCVE-2026-1159339.9Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A routeCVE-2026-1159358.8The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admiCVE-2026-1159377.5The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commCVE-2026-1159388.8Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxCVE-2026-115946.1IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.CVE-2026-115957.5IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console'CVE-2026-115964.7In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user wit
CVE-2026-11590: High severity, CVSS 8.6 | Vulnix