CVE-2026-88930: Unknown Social Web Suite

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Affected products

• Unknown Social Web Suite: up to and including 4.1.12

Published 2026-10-11. Last modified 2026-10-13.