Mmastodon TechnologyCybersecurity first seen 18 h ago, last 18 h ago, peak #4

Tcard WP WordPress plugin hit by SQL injection flaw

Original: 🚨 EUVD-2026-96751 📊 Score: n/a 📦 Product: Tcard WP 🏢 Vendor: Unknown 📅 Updated: 2026-10-11 📝 The Tcard WP WordPress plug

A vulnerability tracked as EUVD-2026-96751 affects the Tcard WP WordPress plugin through version 1.8.0. The plugin fails to sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing attackers to inject SQL. Site administrators running the plugin are advised to update or disable it while a patched version is confirmed.

Why now: WordPress admins are being warned about an unauthenticated SQL injection in a widely installed plugin.

Tcard WPWordPressENISA EUVD

Open on mastodon →

Evidence

• 🚨 EUVD-2026-96751 📊 Score: n/a 📦 Product: Tcard WP 🏢 Vendor: Unknown 📅 Updated: 2026-10-11 📝 The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/1834794