CVE-2026-96327
CriticalCVSS 9.3Summary
The WPLMS plugin (versions before 1.9.9.8.2) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to or modify database data, potentially leading to the exposure of sensitive information.
Recommendation
Update the WPLMS plugin to version 1.9.9.8.2 or later. If an update is not possible, consider disabling the plugin until it is patched.
Other vulnerabilities in WPLMS
See all- CVE-2026-95607High
Blind SQL Injection vulnerability in the WPLMS plugin. Affects versions from n/a through 4.973.
- CVE-2026-39722High
Unauthenticated Cross Site Scripting (XSS) in WPLMS versions up to 4.972.
- CVE-2025-63035Medium
DOM-Based XSS vulnerability in WPLMS plugin by VibeThemes. Improper input neutralization during web page generation allows client-side script injection.
- CVE-2025-53420High
Reflected XSS vulnerability in VibeThemes WPLMS plugin (wplms_plugin) up to version 1.9.9.8 due to improper input neutralization during web page generation.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS