CVE-2026-89285 — Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers…
Published: 2026-10-11 · CVSS: 8.6 · CVSS 3.1
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7