CVE-2026-104122: Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

Q: Who can exploit this issue?

A user with Contributor-level access or higher can exploit it. This means the issue is most relevant to WordPress sites where untrusted or insufficiently trusted users can create or manage content at the Contributor role or above.

Q: Which plugin versions are affected?

The vulnerability affects Ukr-To-Lat WordPress plugin versions through 1.3.5.

Published Oct 17, 2026

Updated

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.

Affected Software

1 affected component

Ukr-To-Lat Ukr-To-Lat WordPress plugin<=1.3.5

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with Contributor-level access or higher can exploit it. This means the issue is most relevant to WordPress sites where untrusted or insufficiently trusted users can create or manage content at the Contributor role or above.

Which plugin versions are affected?

The vulnerability affects Ukr-To-Lat WordPress plugin versions through 1.3.5.

CVE-2026-104122: Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?