Live › vulnerability › CVE-2026-111852
Go to dashboardThe Ajax Search Lite WordPress plugin builds an SQL command from unsanitized input, so a remote visitor can run blind SQL queries. An attacker can read site data, including user records and password hashes, from the WordPress database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version in the WordPress admin under Plugins; versions through 4.14.6 are affected.
Update Ajax Search Lite to a version later than 4.14.6; the first fixed version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-111852")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.