PULSE
LIVE36signals / 24h
ES
FEED
ransomunsafe reclama a Presentations.AI · US · Technologyransomakira reclama a Alcast · Manufacturingransompanzer reclama a The Minor Food Group · TH · Agriculture and Food Productionransomakira reclama a One Vision Imaging · Healthcareransomakira reclama a i4 Solutions · Technologyransomglobal secret group reclama a MACOFIN HELLAS S.A. · GR · Financial Servicesransomqilin reclama a City of Winchester · US · Government & Defenseransomqilin reclama a B Wright Drywall · US · Manufacturingransomglobal secret group reclama a Cook Remodeling · US · Otherransomstorm reclama a Southern Metals · US · Manufacturingransomstorm reclama a TRP International · US · Otherransomstorm reclama a Supportive Insurance Services · US · Financial Servicesransomwallstreet reclama a T.RAD North America · US · Technologyransomwallstreet reclama a Black Hills Bentonite · US · Manufacturingransomunsafe reclama a Presentations.AI · US · Technologyransomakira reclama a Alcast · Manufacturingransompanzer reclama a The Minor Food Group · TH · Agriculture and Food Productionransomakira reclama a One Vision Imaging · Healthcareransomakira reclama a i4 Solutions · Technologyransomglobal secret group reclama a MACOFIN HELLAS S.A. · GR · Financial Servicesransomqilin reclama a City of Winchester · US · Government & Defenseransomqilin reclama a B Wright Drywall · US · Manufacturingransomglobal secret group reclama a Cook Remodeling · US · Otherransomstorm reclama a Southern Metals · US · Manufacturingransomstorm reclama a TRP International · US · Otherransomstorm reclama a Supportive Insurance Services · US · Financial Servicesransomwallstreet reclama a T.RAD North America · US · Technologyransomwallstreet reclama a Black Hills Bentonite · US · Manufacturing
← All CVEs
CVE WatchAug 10, 2026

CVE-2026-18666

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Aug 10, 2026 · Last modified: Aug 10, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.

Official references
Related CVEs

No related CVEs by CWE or product.