// collapsArchList.php lines 64-80
	if ( !empty($inExcludeYear) && !empty($inExcludeYears) ) {
		$exterms = preg_split('/[,]+/',$inExcludeYears);
    if ($inExcludeYear=='include') {
      $in='IN';
    } else {
      $in='NOT IN';
    }
		if ( count($exterms) ) {
			foreach ( $exterms as $exterm ) {
				if (empty($inExclusionsYear))
					$inExclusionsYear = "'" .$exterm . "'";
				else
					$inExclusionsYear .= ", '" . $exterm . "' ";
			}
		}
	}
	if ( empty($inExclusionsYear) ) {
		$inExcludeYearQuery = "";
  } else {
    $inExcludeYearQuery ="AND YEAR($wpdb->posts.post_date) $in ($inExclusionsYear)";
  }

---

// collapsArchList.php lines 91-106
  $postquery= "SELECT $wpdb->terms.slug, $wpdb->posts.ID,
    $wpdb->posts.post_name, $wpdb->posts.post_title, $wpdb->posts.post_author,
    $wpdb->posts.post_date, YEAR($wpdb->posts.post_date) AS 'year',
    MONTH($wpdb->posts.post_date) AS 'month' ,
    $wpdb->posts.post_type
    FROM $wpdb->posts LEFT JOIN $wpdb->term_relationships ON $wpdb->posts.ID =
    $wpdb->term_relationships.object_id
		LEFT JOIN $wpdb->term_taxonomy ON $wpdb->term_taxonomy.term_taxonomy_id =
																			$wpdb->term_relationships.term_taxonomy_id
		LEFT JOIN $wpdb->terms ON $wpdb->terms.term_id =
		                          $wpdb->term_taxonomy.term_id
  WHERE post_status='publish' $postTypeQuery $inExcludeYearQuery $inExcludeCatQuery
  GROUP BY $wpdb->posts.ID
  ORDER BY $wpdb->posts.post_date $sort";

  $allPosts=$wpdb->get_results($postquery);

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/collapsing-archives/3.0.7/collapsArchList.php /home/deploy/wp-safety.org/data/plugin-versions/collapsing-archives/3.0.8/collapsArchList.php
--- /home/deploy/wp-safety.org/data/plugin-versions/collapsing-archives/3.0.7/collapsArchList.php	2025-05-05 06:53:26.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/collapsing-archives/3.0.8/collapsArchList.php	2026-02-12 03:40:52.000000000 +0000
@@ -52,28 +52,28 @@
   } else {
     $inExcludeCatQuery ="AND $wpdb->terms.slug $in ($inExclusionsCat)";
   }
-	$inExclusionsYear = array();
+	$inExcludeYearQuery = "";
 	if ( !empty($inExcludeYear) && !empty($inExcludeYears) ) {
-		$exterms = preg_split('/[,]+/',$inExcludeYears);
-    if ($inExcludeYear=='include') {
-      $in='IN';
-    } else {
-      $in='NOT IN';
-    }
+		$exterms = preg_split('/[,]+/', $inExcludeYears);
+		// Validate $inExcludeYear to prevent SQL injection.
+		$in = ( $inExcludeYear === 'include' ) ? 'IN' : 'NOT IN';
 		if ( count($exterms) ) {
+			$sanitized_years = array();
 			foreach ( $exterms as $exterm ) {
-				if (empty($inExclusionsYear))
-					$inExclusionsYear = "'" .$exterm . "'";
-				else
-					$inExclusionsYear .= ", '" . $exterm . "' ";
+				$year = absint( trim( $exterm ) );
+				if ( $year > 0 ) {
+					$sanitized_years[] = $year;
+				}
+			}
+			if ( ! empty( $sanitized_years ) ) {
+				$placeholders = implode( ', ', array_fill( 0, count( $sanitized_years ), '%d' ) );
+				$inExcludeYearQuery = $wpdb->prepare(
+					"AND YEAR($wpdb->posts.post_date) $in ($placeholders)",
+					$sanitized_years
+				);
 			}
 		}
 	}
-	if ( empty($inExclusionsYear) ) {
-		$inExcludeYearQuery = "";
-  } else {
-    $inExcludeYearQuery ="AND YEAR($wpdb->posts.post_date) $in ($inExclusionsYear)";
-  }