CVE Catalog
CVE-2026-96345
HighCVSS 7.6Summary
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
Risk Assessment
An administrator can inject malicious SQL queries, potentially leading to unauthorized database access, data theft, or modification.
Recommendation
Update the Estatik plugin to a version that fixes this vulnerability.
Other vulnerabilities in Estatik
See all- CVE-2026-96350Critical
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
- CVE-2026-81775High
Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS