CVE-2026-73185

CriticalCVSS 9.3

Published: 19/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.

Risk Assessment

Risk includes data leakage, modification or deletion of database data, and in extreme cases server takeover. The attack can be performed remotely without authentication.

Recommendation

Update the NGG Smart Image Search plugin to version 4.0.0 or later. Also check for potential data breach.

Other vulnerabilities in NGG Smart Image Search

CVE-2025-58027Medium
The NGG Smart Image Search plugin contains a Stored XSS vulnerability in versions up to and including 3.4.3. An attacker can inject a malicious script that executes in the user's browser.

Original NVD description (English source)

Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS