CVE-2026-2508

MediumCVSS 6.5/10Last modified Jun 25, 2026

Description

The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-250838.7GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows CVE-2026-250849.8Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.CVE-2026-250859.8A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine i CVE-2026-250867.7Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send maliciou CVE-2026-250877.0Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when CVE-2026-250888.8An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6 CVE-2026-250899.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 th CVE-2026-25096.4The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes fiel CVE-2026-250998.8Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, w CVE-2026-251005.4Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload p CVE-2026-251019.8Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. T CVE-2026-251047.8A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted