WordPress plugin
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High9
- Medium18
- Low0
All WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert ≤5.5.89Update to 5.5.90 | CVE-2026-118267 | |
| High7.5 | Unauthenticated SQL Injection ≤5.5.82Update to 5.5.83 | CVE-2026-95605 | |
| High7.5 | Unauthenticated SQL Injection ≤5.5.84Update to 5.5.85 | CVE-2026-93621 | |
| High7.5 | Unauthenticated SQL Injection ≤5.5.81Update to 5.5.82 | CVE-2026-81293 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤5.5.79Update to 5.5.80 | CVE-2026-66663 | |
| High7.5 | Unauthenticated SQL Injection ≤5.5.70Update to 5.5.71 | CVE-2026-42665 | |
| High7.5 | Unauthenticated SQL Injection ≤5.5.22Update to 5.5.23 | CVE-2024-12428 | |
| High7.5 | Authenticated (Subscriber+) Privilege Escalation ≤5.3.7Update to 5.3.8 | CVE-2023-1874 | |
| High7.2 | Admin+ SQL Injection ≤4.3.1Update to 5.0.0 | CVE-2021-24866 |
- High8.1Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert
≤5.5.89Update to 5.5.90
- High7.5Unauthenticated SQL Injection
≤5.5.82Update to 5.5.83
- High7.5Unauthenticated SQL Injection
≤5.5.84Update to 5.5.85
- High7.5Unauthenticated SQL Injection
≤5.5.81Update to 5.5.82
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.5.79Update to 5.5.80
- High7.5Unauthenticated SQL Injection
≤5.5.70Update to 5.5.71
- High7.5Unauthenticated SQL Injection
≤5.5.22Update to 5.5.23
- High7.5Authenticated (Subscriber+) Privilege Escalation
≤5.3.7Update to 5.3.8
- High7.2Admin+ SQL Injection
≤4.3.1Update to 5.0.0
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: common questions
Does WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps have known vulnerabilities?
Yes. VulnCrest Radar lists 27 known vulnerabilities in WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: 9 high, 18 medium. At least one is not fixed in the latest version.
How do I check which version of WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerability?
CVE-2026-121783, published Nov 7, 2026: WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.90 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).
Is any WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerability listed in CISA KEV?
No. None of the known WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerabilities is currently listed in the CISA KEV catalog.