CVE-2026-89303

MediumCVSS 6.4/10Last modified Sep 28, 2026

Description

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	Post Voting System	<= 1.0

References

https://wpscan.com/vulnerability/dbe62e96-6493-4385-92a2-6281c5428a9f/

Timeline

Published: Sep 28, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-893046.5The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauth CVE-2026-893056.5The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any au CVE-2026-893075.1The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via th CVE-2026-893089.3An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary comman CVE-2026-8930910.0The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Autho CVE-2026-89319.4A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.CVE-2026-893109.9A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker CVE-2026-893126.9`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **pa CVE-2026-893136.3`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `CVE-2026-893146.9`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square CVE-2026-893156.9`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped CVE-2026-893166.3`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC