CVE-2026-12741

Name of the Vulnerable Software and Affected Versions WP Fast Total Search – The Power of Indexed Search versions prior to 1.80.281

Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database via the form data[s] parameter.

Recommendations Update WP Fast Total Search – The Power of Indexed Search to a version newer than 1.80.280. Avoid using the form data[s] parameter until the plugin is updated.