CVE-2026-93000

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.

  • Published Sep 28, 2026
  • CVSS 6.8 medium
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-93000 at the National Vulnerability Database