CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1236)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Unauthorised Private Post Access
Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery
≤3.4.1Update to 3.4.2
- High7.2File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.12Update to 3.3.13
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Registration Forms
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Preview E-mails for WooCommerce
≤1.6.8Update to 2.0.0
- Medium6.4Reflected Cross-Site Scripting
Child Theme Generator
≤2.2.7No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Backup Migration
≤1.1.5Update to 1.1.6
- High8.8Cross-Site Request Forgery
Push Notifications for WordPress (Lite)
<6.0.1Update to 6.0.1
- Medium6.4Cross-Site Scripting
Mortgage Calculator
<1.5.17Update to 1.5.17
- Medium6.1Reflected Cross-Site Scripting
SportsPress – Sports Club & League Manager
≤2.7.8Update to 2.7.9
- Critical9.8Unauthenticated Arbitrary File Upload
Wordpress Plugin Smart Product Review
≤1.0.4Update to 1.0.5
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.0.6.1Update to 7.0.6.2
- Medium4.3Subscriber+ Plugin Settings Update
Temporary Login Without Password
≤1.7.0Update to 1.7.1
- Medium6.1Reflected Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.1Update to 2.6.2
- Critical9.0Unauthenticated PHP Object Injection
ToTop Link
≤1.7.1No patch available
- Medium6.1Reflected Cross-Site Scripting via current_month_divider parameter
Modern Events Calendar Lite
≤6.1.0Update to 6.1.5
- Medium4.3Improper Access Control
User meta shortcodes
≤0.5No patch available
- Medium5.4Stored Cross-Site Scripting
Display Post Metadata
<1.5.0Update to 1.5.0
- High7.2Admin+ Local File Inclusion
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤2.4.9Update to 2.5.0
- Medium4.3Missing Authorization
Page/Post Content Shortcode
≤1.0No patch available
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
WP Admin Logo Changer
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Activity Log for WordPress
<1.0.21Update to 1.0.21
- Critical9.8Unauthenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.67Update to 6.67
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Flex Local Fonts
≤1.0.0No patch available