CVE-2026-81420

Published 11 October 2026 · tracked since 12 October 2026

Description

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-108753 CRITICAL 9.4
• CVE-2026-96227 HIGH 8.8
• CVE-2026-89232 HIGH 8.6
• CVE-2026-89234 HIGH 8.6
• CVE-2026-89283 HIGH 8.6
• CVE-2026-89285 HIGH 8.6
• CVE-2026-89287 HIGH 8.6
• CVE-2026-89297 HIGH 8.6
• CVE-2026-88826 HIGH 8.8
• CVE-2026-88827 HIGH 8.8

→ Open the live CVE board · all tools