CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 113)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
WPC Product Bundles for WooCommerce
≤8.6.6Update to 8.6.7
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
RW Elephant Rental Inventory
≤2.3.13Update to 2.4.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Custom Field Template
≤2.7.8Update to 2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
Contextual Related Posts
≤4.4.1Update to 4.4.2
- High7.2Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.17Update to 4.1.18
- Medium6.1Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Booking Calendar
≤11.8.3Update to 11.8.4
- Critical9.8Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Meta Box User Profile
≤2.5.16Update to 2.6.0
- Critical9.8Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Give Tributes
≤2.3.1Update to 2.3.1.1
- Medium4.9Authenticated (Administrator+) SQL Injection
HashBar – Announcement, Notification Bar & Popup Campaign
≤2.0.3Update to 2.0.4
- Medium4.3Missing Authorization
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.3Update to 5.4
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
3.1.0 – 8.9.4Update to 8.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JSM Show Post Metadata
≤4.9.0Update to 4.9.1
- Medium4.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.38.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.5 – 8.9.4Update to 8.9.5
- Medium5.36.17.4.1 - Unauthenticated Information Exposure
The Events Calendar
4.5 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Information Exposure
WPC Smart Compare for WooCommerce
≤6.6.0Update to 6.6.1
- High7.5Unauthenticated SQL Injection
JetFormBuilder Stripe Gateway
≤1.0.0Update to 1.1.0
- Medium5.3Unauthenticated Information Exposure
NP Quote Request for WooCommerce
≤2.4.15Update to 2.4.16
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
WP Ultimate Review
≤2.4.2Update to 2.4.3
- Medium4.35.7.2 - Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
5.3.6 – 5.7.2Update to 5.7.3
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated CAPTCHA Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.32.0.15 - Unauthenticated Information Exposure
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
1.95 – 2.0.15Update to 2.1.0
- Medium5.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.0 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Poll Vote Limit Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1