VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 119)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 119)
SeverityVulnerabilityCVEInstallsPublished
Medium6.5Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Download Manager≤3.3.68Update to 3.3.69
CVE-2026-92714—
Medium5.35.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Divi5.0 – 5.11.1Update to 5.12.0
CVE-2026-91707—
Medium6.1Reflected Cross-Site Scripting via 'options' Parameter
Booking Calendar≤11.8.2Update to 11.8.3
CVE-2026-92561—
High7.2Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
Booking Calendar≤11.8.2Update to 11.8.3
CVE-2026-92619—
High8.8Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF≤6.5.5Update to 6.5.6
CVE-2026-17086—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg≤1.5.2No patch available
CVE-2026-15650—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg≤1.5.1Update to 1.5.2
CVE-2026-14855—
Medium4.3Cross-Site Request Forgery
Asset CleanUp: Page Speed Booster≤1.4.0.5Update to 1.4.0.6
CVE-2026-66571—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlog≤2.4.10Update to 2.4.10.1
CVE-2026-66572—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTabs≤2.3.3.1Update to 2.3.3.2
CVE-2026-66573—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons≤8.8.3Update to 8.8.4
CVE-2026-66574—
Medium5.3Unauthenticated Insecure Direct Object Reference
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder≤51.1.81Update to 51.1.82
CVE-2026-66575—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlocks for Elementor≤1.5.2Update to 1.5.2.1
CVE-2026-66576—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSearch≤3.6.3Update to 3.6.3.1
CVE-2026-66577—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Property Hive≤2.2.6Update to 2.3.0
CVE-2026-66578—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements≤2.9.2.1Update to 2.9.2.2
CVE-2026-66579—
Medium6.5Authenticated (Contributor+) SQL Injection
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels≤7.12.0Update to 7.12.1
CVE-2026-66580—
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Unlimited Elements for Elementor≤2.0.19Update to 2.0.20
CVE-2026-66608—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Issues and Series for Newspapers, Magazines, Publishers, Writers≤3.1.3Update to 3.1.4
CVE-2026-66617—
Medium4.9Authenticated (Administrator+) SQL Injection
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings≤4.9.9Update to 5.0.0
CVE-2026-66618—
Medium4.9Authenticated (Administrator+) SQL Injection
Newsletters≤4.18Update to 4.18.1
CVE-2026-66619—
Medium4.9Authenticated (Administrator+) SQL Injection
WPMasterToolKit (WPMTK) – All in one plugin≤2.22.0Update to 2.23.1
CVE-2026-66624—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
Brizy – Page Builder≤2.8.14Update to 2.8.15
CVE-2026-2585—
Medium4.3Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.6.9Update to 5.6.10
CVE-2026-18441—
Medium4.9Authenticated (Administrator+) SQL Injection
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors≤2.7.2.1Update to 2.7.2.2
CVE-2026-66625—
Medium5.4Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Booking for Appointments and Events Calendar – Amelia≤2.4.4Update to 2.4.5
CVE-2026-14311—
Medium5.3Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Booking for Appointments and Events Calendar – Amelia≤2.4.5Update to 2.4.6
CVE-2026-16582—
Medium4.9Authenticated (Editor+) SQL Injection
SKT Addons for Elementor≤4.0Update to 4.1
CVE-2026-66626—
Medium4.9Authenticated (Shop Manager+) SQL Injection
WP-Lister Lite for eBay≤3.8.11Update to 3.8.12
CVE-2026-66628—
Medium4.9Authenticated (Administrator+) SQL Injection
Issues and Series for Newspapers, Magazines, Publishers, Writers≤3.1.3Update to 3.1.4
CVE-2026-66630—

Search VulnCrest Radar

Jump to

Are you sure?