CVE-2026-94298 — BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query,…
Published: 2026-10-02 · CVSS: 6.2 · CVSS 3.1
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7