CVE-2026-95599
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Blind SQL Injection vulnerability in the Taskbuilder plugin. Affects versions from n/a through 6.0.5.
Risk Assessment
An attacker can execute database queries, potentially leading to data leakage or modification.
Recommendation
Update the Taskbuilder plugin to the latest available version that includes the security fix.
Other vulnerabilities in Taskbuilder
See all- CVE-2026-12110Medium
The Taskbuilder plugin for WordPress up to version 5.0.8 is vulnerable to generic SQL injection via the 'task_search' parameter due to insufficient escaping and lack of query preparation. Authenticated attackers with subscriber-level access or higher can append malicious SQL queries.
- CVE-2026-12090Medium
The Taskbuilder plugin for WordPress is vulnerable to generic SQL injection via the 'wppm_proj_filter' parameter in versions up to 5.0.8. Insufficient escaping and lack of query preparation allow authenticated attackers (subscriber-level and above) to append additional SQL queries, enabling extraction of sensitive database information.
- CVE-2026-52697High
There is a SQL Injection vulnerability in Taskbuilder versions <= 5.0.7 that can be exploited by subscribers.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS