CVE-2026-39479

HighCVSS 7.6/10Last modified Jul 24, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Brainstorm Force	OttoKit	<= 1.1.20

References

https://patchstack.com/database/Wordpress/Plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-20-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-394807.5Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-394817.2Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.CVE-2026-394826.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expir CVE-2026-394836.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidekazu Ishikawa VK All in One Expans CVE-2026-394844.7URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affe CVE-2026-394854.3Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Contr CVE-2026-394868.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-mon CVE-2026-394877.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking all CVE-2026-394886.5Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.Th CVE-2026-394894.4Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.CVE-2026-39493.3A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/de CVE-2026-394907.5Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.