Ghostwire
Home / Vulnerabilities / CVE-2026-104122

CVE-2026-104122: The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query,...

MEDIUM CVSS 0.0

Published: October 17, 2026 | Last Modified: October 17, 2026

Description

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.

Ghostwire Analysis — What This Means Practically

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References