CVE Catalog
CVE-2026-16949
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk0.21%
12th percentile - higher than 12% of all known CVEs
Summary
The Term Pages WordPress plugin before version 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Risk Assessment
Risk includes database access, data theft, content modification, and potential administrator account takeover.
Recommendation
Immediately update the plugin to version 2.0.0 or later and use prepared statements for all SQL queries.
Original NVD description (English source)
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.