CVE-2026-96345
HighCVSS 7.6Summary
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
Risk Assessment
An administrator can inject malicious SQL queries, potentially leading to unauthorized database access, data theft, or modification.
Recommendation
Update the Estatik plugin to a version that fixes this vulnerability.
Other vulnerabilities in Estatik
See all- CVE-2026-96350Critical
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
- CVE-2026-81775High
Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2025-62963Medium
The Estatik plugin for WordPress (versions up to and including 4.3.1) is vulnerable to DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This may allow execution of malicious script in the user's browser.
Original NVD description (English source)
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS