CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 122)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Protection Mechanism Bypass
Hide My WP Ghost – Security & Firewall
≤7.0.10Update to 7.0.11
- Medium5.34.1.3 - Missing Authorization
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
4.0.0 – 4.1.3Update to 4.2.0
- High7.24.1.3 - Unauthenticated Stored Cross-Site Scripting
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
4.0.0 – 4.1.3Update to 4.2.0
- High7.21.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
VikBooking Hotel Booking Engine & PMS
1.8.8 – 1.8.14Update to 1.8.15
- Medium5.3Unauthenticated Payment Bypass
RestroPress – Online Food Ordering System
≤3.4.5Update to 3.4.6
- Medium4.351.1.80 - Missing Authorization
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.3Unauthenticated Cache Poisoning
Breeze Cache
≤2.5.14Update to 2.5.15
- Medium4.3Cross-Site Request Forgery
aVideo
≤29.0No patch available
- Medium4.3Authenticated (Subscriber+) Username Enumeration
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- High7.5Unauthenticated SQL Injection
Tz Weekly Radio Schedule
≤1.8.1No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
RestroPress – Online Food Ordering System
<3.4.8Update to 3.4.8
- High7.2Authenticated (Shop Manager+) Remote Code Execution
AF Companion – AI SEO, GEO, Alt Text, Performance & Site Health
≤2.1.0Update to 2.2.0
- Medium4.7Authenticated (Admin+) Privilege Escalation
All-in-One WP Migration and Backup
≤7.110Update to 7.111
- Medium4.3Authenticated (Subscriber+) Information Exposure
Nimble Page Builder
≤3.3.8No patch available
- Medium4.3Missing Authorization
Filter Gallery
≤1.1.4Update to 1.1.5
- Medium4.3Authenticated (Bookit Staff+) Information Exposure
Bookit — Booking & Appointment Calendar
≤2.6.0.4Update to 2.6.0.5
- High7.51.3.31 - Authenticated (Contributor+) Local File Inclusion
All Bootstrap Blocks
1.3.20 – 1.3.31No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
iGMS Direct Booking
≤1.0Update to 2.0
- High7.5Unauthenticated SQL Injection
Tz Weekly Radio Schedule
≤1.8.1No patch available
- High7.5Unauthenticated SQL Injection
Price Drop Alert for Woo Commerce
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
wp shortcut link and advertisement baner
≤1.2.0No patch available
- Medium4.3Authenticated (Contributor+) Information Exposure
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
Bold Page Builder
≤5.9.6Update to 5.9.7
- Medium6.1Reflected Cross-Site Scripting via 'icn' Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.22Update to 2.15.23
- High7.2Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request
WP-Lister Lite for eBay
≤3.8.9Update to 3.8.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
Advanced Popups
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.16Update to 2.8.17