CVE WATCH / VULNERABILITY DETAIL
CVE-2025-9462
MEDIUMCVSS 6.5NVD feed
Published 31 October 2026 · tracked since 31 October 2026
Description
The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.5.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for auth
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-118636 CRITICAL 9.8
- CVE-2026-120203 HIGH 8.8
- CVE-2026-76010 HIGH 8.8
- CVE-2026-120114 HIGH 7.2
- CVE-2026-109197 HIGH 7.5
- CVE-2026-118235 CRITICAL 9.8
- CVE-2026-120075 HIGH 7.2
- CVE-2026-103882 CRITICAL 9.1
- CVE-2026-110530 HIGH 7.2
- CVE-2026-119096 CRITICAL 9.8