PickPlugins Question Answer vulnerabilities

Latest PickPlugins Question Answer CVEs

Newest publication first

1. CVE-2026-10207 PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

   Published 2026-07-28

   High·CVSS 7.5

   The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash(...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.