CVE-2026-120688

Name of the Vulnerable Software and Affected Versions EZ SQL Reports Shortcode Widget and DB Backup versions prior to 5.25.26

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs when an administrator saves a SQL report that selects an attacker-controllable database column, such as HTTP USER AGENT or wp comments.comment agent. The injected scripts execute whenever a user accesses the affected page.

Recommendations Update EZ SQL Reports Shortcode Widget and DB Backup to version 5.25.26 or later.