CVE-2026-12512: Unknown Quotes Llama

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

Affected products

• Unknown Quotes Llama: before 3.1.6 (fixed in 3.1.6)

Published 2026-07-15. Last modified 2026-07-15.