CVE-2026-14554

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS

0.22% chance of exploitation in the next 30 days, 13th percentile

Published

2026-07-31

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/

References

• CVE Record
• NVD entry

Related

• CVE-2026-14553
• CVE-2026-14557
• CVE-2026-14550
• CVE-2026-14558
• CVE-2026-14549
• CVE-2026-1456