CVE-2026-84068

HighCVSS 8.6

Published: 09/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Quentn WP WordPress plugin before version 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

Risk Assessment

An unauthenticated attacker can extract sensitive data such as user credentials or other confidential information, posing a serious threat to privacy and security.

Recommendation

Update the Quentn WP plugin to version 1.2.15 or later, which includes fixes for the SQL injection vulnerability.

Other vulnerabilities in Quentn WP

CVE-2026-84113Medium
The Quentn WP WordPress plugin before version 1.2.15 does not properly sanitize and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.

Original NVD description (English source)

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS