CVE-2026-16061

HighCVSS 8.6/10Last modified Aug 31, 2026

Description

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2026
Last modified
Aug 31, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-160626.6The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in soCVE-2026-160635.4The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by useCVE-2026-160645.4The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modifiedCVE-2026-160656.5The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it inCVE-2026-160665.4The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pagesCVE-2026-160675.3The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its naCVE-2026-160683.5The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part oCVE-2026-160696.8The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJCVE-2026-16076.4The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `surbma-bookingcom` shCVE-2026-160702.7The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's tCVE-2026-160715.4A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue ocCVE-2026-160724.9A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can