MajorCritical vulnerability
CVE-2026-89296 (CVSS 8.6)
NVD · officialPublished Oct 1, 2026Risk 37/100
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Technical details
CVSS
8.6
AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:NoneA:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source