TI-2026-63888 CVE-2026-96826 · GHSA-vxxw-p436-qh27WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerabilityPriority LOW 33Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection.CVSS 3.1HIGH 7.6· Network · High privileges · No interaction · EPSS 0.00383 · Published 2026-09-23 · No fix listed CWE-89