CVE-2026-96826

HighCVSS 7.6/10Last modified Sep 24, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection.

This issue affects W4 Post List: from n/a through 3.0.6.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-968277.6Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2026-968287.6Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-968296.5Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.CVE-2026-968307.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.CVE-2026-968318.8Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.CVE-2026-968327.2Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.CVE-2026-968337.2Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.CVE-2026-968346.5Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.CVE-2026-968356.5Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.CVE-2026-968367.1Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.CVE-2026-968378.8Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.CVE-2026-968388.8Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification
CVE-2026-96826: High severity, CVSS 7.6 | Vulnix