CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1234)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8SQL Injection
WPcalc – create any online calculators
≤2.1No patch available
- High7.5Denial of Service
Stars Rating
<3.5.1Update to 3.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3
- Medium4.8Reflected Cross-Site Scripting via tab and section parameter
PDF Invoices & Packing Slips for WooCommerce
<2.10.5Update to 2.10.5
- Medium6.1Reflected Cross-Site Scripting
Use-your-Drive | Google Drive plugin for WordPress
<1.18.3Update to 1.18.3
- Medium6.1Chaty <= 2.8.2 Reflected Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
<2.8.3Update to 2.8.3
- Medium4.7Reflected Cross-Site Scripting
Share-one-Drive | OneDrive & SharePoint plugin for WordPress
<1.15.3Update to 1.15.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Modal Window – create popup modal window
<5.2.2Update to 5.2.2
- High8.8Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.2Update to 2.3.3
- High8.8Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery
WP Coder – Insert & Manage Code Snippets
≤2.5.1Update to 2.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤2.0.6Update to 2.0.7
- Medium5.4Subscriber+ Category Add Leading to Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.1.6Update to 6.2.0
- Medium5.4Cross-Site Scripting
Customize Login Image
≤3.4Update to 3.5
- Medium6.4Cross-Site Scripting
Post Duplicator
<2.24Update to 2.24
- High7.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium4.3Missing Authorization on Option Changes
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium5.5Editor+ Stored Cross-Site Scripting
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤5.3.0Update to 5.3.1
- Medium6.1Reflected Cross-Site Scripting in Product XML Feeds Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in PDF Invoicing Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Variation Swatches for WooCommerce
≤2.1.1Update to 2.1.2
- Medium6.1Reflected Cross-Site Scripting in General Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium4.9Admin+ Arbitrary Folder Deletion via Path Traversal
CAOS | Host Google Analytics Locally
≤4.1.8Update to 4.1.9
- Medium4.9Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.11Update to 4.5.12
- Medium6.5Authorization Bypass
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- Medium6.1Reflected Cross-Site Scripting via qc_res
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- High8.8Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.7Update to 1.6.8
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Typebot
<1.4.3Update to 1.4.3
- Medium6.1Reflected Cross-Site Scripting
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available
- Medium5.3Sensitive Data Exposure
CorreosExpress – Shipping Management – Tags
≤2.6.0No patch available