VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 112)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 112)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Unauthenticated (Subscriber+) Unauthorized Course Enrollment
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-88848—
Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-88847—
Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-88845—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid≤7.9.4Update to 7.9.5
CVE-2026-84151—
Medium4.3Authenticated (Subscriber+) Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates≤3.4.1Update to 3.4.2
CVE-2026-82850—
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates≤3.4.1Update to 3.4.2
CVE-2026-82849—
High7.5Authenticated (Subscriber+) PHP Object Injection
wpForo Forum≤3.1.5Update to 3.1.6
CVE-2026-80513—
Medium4.3Missing Authorization
CMB2≤2.12.0Update to 2.13.0
CVE-2026-80338—
Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution≤2.1.71Update to 2.1.72
CVE-2026-93344—
Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution≤2.1.71Update to 2.1.72
CVE-2026-93343—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Refund Requests
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution≤2.1.71Update to 2.1.72
CVE-2026-93341—
High8.1Unauthenticated PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.3Update to 3.15.4
CVE-2026-91827—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher≤2.8.25Update to 2.8.26
CVE-2026-89002—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Styler≤1.1.1No patch available
CVE-2026-88788—
Medium4.9Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels≤6.6.43Update to 6.6.44
CVE-2026-15095—
High7.5Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
WP Travel Engine – Tour Booking Plugin – Tour Operator Software≤6.8.0Update to 6.8.1
CVE-2026-9231—
Medium5.3Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
PixelPlay≤1.0.2No patch available
CVE-2025-14486—
Medium5.3Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
Image Buzz≤1.0.3No patch available
CVE-2025-14484—
High8.8Authenticated (Subscriber+) Arbitrary File Deletion
BM Content Builder<3.17.1Update to 3.17.1
CVE-2025-1281—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Handily≤1.0.3Update to 1.0.4
CVE-2025-14487—
Medium6.5Authenticated (Subscriber+) Arbitrary File Read
BM Content Builder<3.17.1Update to 3.17.1
CVE-2025-1280—
Medium4.3Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
WP-CRM System – Manage Clients and Projects≤3.4.6Update to 3.4.7
CVE-2026-9004—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More≤6.2.1Update to 6.2.2
CVE-2026-7622—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Live Composer – Free WordPress Website Builder≤2.1.21Update to 2.1.22
CVE-2026-16778—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
Hostel≤1.1.8No patch available
CVE-2026-1645—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
wpForo Forum≤3.1.5Update to 3.1.6
CVE-2026-91092—
High7.2Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
WP Yelp Review Slider≤9.2Update to 9.3
CVE-2026-93778—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory≤2.9.18Update to 2.9.19
CVE-2026-18345—
High7.12.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
WP Table Builder – Drag & Drop Table Builder2.1.1 – 2.1.13Update to 2.1.14
CVE-2026-6922—
High8.1Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard≤1.4.4Update to 1.4.5
CVE-2026-92969—

Search VulnCrest Radar

Jump to

Are you sure?