8.6
High
CVE-2026-89214 The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a…
Description
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WpCues Basic Quiz 1.6 | earliest → 1.6.5 | No fix stated |