CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 114)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.310.8.1 - Unauthenticated Arbitrary User Meta Corruption
WP Recipe Maker
9.8.0 – 10.8.1Update to 10.8.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.9.1 – 8.9.4Update to 8.9.5
- Medium5.38.9.4 - Unauthenticated Information Exposure
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.1 – 8.9.4Update to 8.9.5
- High8.8Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
WP OAuth Server ( Login with WordPress )
≤6.3.0Update to 6.4.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment Plugins for PayPal WooCommerce
≤2.0.26Update to 2.0.27
- Medium5.3Unauthenticated Payment Manipulation
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Remote Code Execution
YAHMAN Add-ons
≤0.9.30Update to 0.9.31
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium5.37.5.1 - Unauthenticated Information Exposure
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster
7.0.0 – 7.5.1Update to 7.5.2
- Medium5.3Unauthenticated Information Exposure
Post Grid Gutenberg Blocks – PostX
≤5.0.40Update to 5.0.41
- Medium4.310.8.1 - Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
10.3.0 – 10.8.1Update to 10.8.2
- Medium6.3Authenticated (Subscriber+) HTML Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Forged Payment and Subscription Events
Premium Packages – Sell Digital Products Securely
≤7.2.0Update to 7.2.1
- Medium4.3Missing Authorization
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤2.10.3Update to 2.10.4
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- Medium6.41.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form
1.4.1 – 1.6.2Update to 1.6.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium6.5Authenticated (Author+) SQL Injection
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Unauthenticated Payment Bypass
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium4.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.16Update to 5.2.17
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Translate WordPress with GTranslate
≤5.0.0Update to 5.0.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.16.1 – 6.17.4.1Update to 6.17.5