CVE-2026-93000 — SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthent…
Published: 2026-09-28 · CVSS: 6.8 · CVSS 3.1
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7