CVE-2026-42416
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The UDesign Core plugin in versions up to and including 4.15.0 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
Risk Assessment
A low-privileged attacker can read, modify, or delete database data, potentially leading to information disclosure or site takeover. The risk affects all sites running the vulnerable plugin version.
Recommendation
Update the UDesign Core plugin to a version newer than 4.15.0. If no fix is available, consider restricting user registration or disabling the plugin.
Other vulnerabilities in UDesign Core
See all- CVE-2025-62051Medium
The UDesign Core plugin by AndonDesign contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects UDesign Core from n/a through <= 4.14.1.
- CVE-2025-53236Medium
The UDesign Core plugin by AndonDesign is vulnerable to Missing Authorization in versions from n/a through 4.14.0. This issue allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS