CVE-2026-15081

CVE-2026-15081: Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

Vendor Drupal

Product Location Selector

Weakness CWE-89 · SQLi

Published July 10, 2026

Last update July 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

Key dates

02Disclosure timeline

July 10, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-15081 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-57726 WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability CVE-2026-57810 WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability CVE-2026-24552 WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability CVE-2026-65526 WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnerability CVE-2026-13242 Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062