CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1233)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Simple Image Gallery
≤1.0.6No patch available
- Medium6.1Responsive, Flat, Simple FAQ <= 1.4.8 - Reflected Cross-Site Scripting
duoFAQ - Responsive, Flat, Simple FAQ
≤1.4.8No patch available
- High7.5Directory Traversal/Arbitrary File Read
TrueRanker
≤2.2.2Update to 2.2.4
- Critical9.8Pro <= 5.0.6 - SQL Injection
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7.2Update to 1.3.7.3
- Medium6.1Reflected Cross-Site Scripting
H5P CSS Editor
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Magic Post Voice
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Parsian Bank Gateway for Woocommerce
≤1.0No patch available
- Medium4.7Reflected Cross-Site Scripting
WP Cloud Plugins - Box (Lets-Box)
<1.15.3Update to 1.15.3
- Medium6.1Reflected Cross-Site Scripting
link-list-manager
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Out-of-the-Box
<1.20.3Update to 1.20.3
- Medium6.1Reflected Cross-Site Scripting
Real WYSIWYG
≤0.0.2No patch available
- Medium6.1.htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting
.htaccess Redirect
≤0.3.1No patch available
- High7.5Sensitive Data Disclosure
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium6.1WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting
WooCommerce EnvioPack
≤1.2No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤1.0.77.31Update to 1.0.77.32
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
<2.0.15Update to 2.0.15
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
tarteaucitron.io – Cookie Banner & GDPR Consent Management
≤1.5.4Update to 1.6
- Medium6.5Arbitrary Post Deletion via Cross-Site Request Forgery
Accept Donations with PayPal & Stripe
≤1.3.3Update to 1.3.4
- Medium4.8Stored Cross-Site Scripting
Fathom Analytics for WP
≤3.0.4Update to 3.0.5
- Medium5.4Missing Authorization
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Medium5.7Subscriber+ Arbitrary Post Deletion and Plugin Settings Update
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Critical9.8Unauthenticated Arbitrary Options Update
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
<2.3.1Update to 2.3.1
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.0.1.7Update to 5.0.1.8
- Medium6.1Reflected Cross-Site Scripting
10WebSocial
≤1.4.28Update to 1.4.29
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar
≤8.9.1Update to 8.9.2
- Medium4.8Reflected Cross-Site Scripting via tab and section parameter
PDF Invoices & Packing Slips for WooCommerce
<2.10.5Update to 2.10.5
- High8.8SQL Injection
WPcalc – create any online calculators
≤2.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3
- High7.5Unauthenticated Arbitrary Tab Modification
Tab – Accordion, FAQ
<1.3.2Update to 1.3.2