CVE-2026-16079

Name of the Vulnerable Software and Affected Versions Fullscreen Galleria versions prior to 1.6.13

Description The Fullscreen Galleria plugin for WordPress contains a SQL Injection flaw. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with contributor-level access or higher can exploit this by manipulating the href attribute within post content to append malicious SQL queries, allowing the extraction of sensitive information from the database.

Recommendations Update the plugin to a version newer than 1.6.12.