{"id":"CVE-2026-104122","title":"Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name","summary":"The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.","severity":"none","cwe":["CWE-89"],"product":"Ukr-To-Lat","affected":["Ukr-To-Lat <= 1.3.5"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T06:00:13.250Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104122","references":[{"url":"https://wpscan.com/vulnerability/01abcbf8-d256-49b9-b660-38c50506c441/"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T07:01:26.049Z","slug":"CVE-2026-104122","body":"## Overview\n\nThe Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.\n\n## Affected\n\n- `Ukr-To-Lat <= 1.3.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}