{"id":"CVE-2026-104122","title":"Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name","summary":"The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-89"],"product":"Ukr-To-Lat","affected":["Ukr-To-Lat <= 1.3.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-18T11:00:44.907979Z"},"published":"2026-10-17","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:12:32.557Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104122","references":[{"url":"https://wpscan.com/vulnerability/01abcbf8-d256-49b9-b660-38c50506c441/"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T07:01:26.049Z","epss":0.00224,"epssPercentile":0.12931,"slug":"CVE-2026-104122","body":"## Overview\n\nThe Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.\n\n## Affected\n\n- `Ukr-To-Lat <= 1.3.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224043,"id":"CVE-2026-104122","ts":1792323690695,"field":"cvss","old":null,"new":"6.8"},{"seq":224042,"id":"CVE-2026-104122","ts":1792323690695,"field":"severity","old":"none","new":"medium"}]}