CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1237)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Page/Post Content Shortcode
≤1.0No patch available
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available
- Medium4.3Improper Access Control
User meta shortcodes
≤0.5No patch available
- High7.2Admin+ Local File Inclusion
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤2.4.9Update to 2.5.0
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Medium5.5Stored Cross-Site Scripting
Inspirational Quote Rotator
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.2.3Update to 1.2.4
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.4.2Update to 8.4.3
- Medium6.5Cross-Site Request Forgery
Database Addon for Contact Form 7 – CFDB7
≤1.2.5.9Update to 1.2.6.1
- High8.8Authenticated Arbitrary File Upload
WP Popular Posts
≤5.3.2Update to 5.3.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤6.1.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Database Addon for Contact Form 7 – CFDB7
≤1.2.6.1Update to 1.2.6.2
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form Email
≤1.3.24Update to 1.3.25
- Medium6.5Unauthorised Vote Export to Email & IP Addresses Disclosure
Like Button Rating ♥ LikeBtn
≤2.6.37Update to 2.6.38
- Medium4.8Admin+ Stored Cross-Site Scripting
Caldera Forms – More Than Contact Forms
<1.9.5Update to 1.9.5
- High8.8Cross-Site Request Forgery
WP Reset
5.00 – 5.98Update to 5.99
- High8.8Missing Authorization to Database Reset
WP Reset
5.00 – 5.98Update to 5.99
- Medium5.5Arbitrary File Deletion
Error Log Viewer by BestWebSoft
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Booking Package
<1.5.11Update to 1.5.11
- Medium5.4Authenticated Stored Cross-Site Scripting
Meks Easy Photo Feed Widget
<1.2.4Update to 1.2.4
- Critical9.8Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.1.4Update to 4.1.4
- Medium6.4Contributor+ Stored Cross-Site Scripting
Get Custom Field Values
<4.0.1Update to 4.0.1
- Medium6.5Arbitrary Post Metadata Access
Get Custom Field Values
<4.0Update to 4.0
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7Update to 1.3.7.1
- Critical9.8Unauthenticated SQL Injection
Registrations for the Events Calendar – Event Registration Plugin
<2.7.6Update to 2.7.6
- High7.2Admin+ SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤4.3.1Update to 5.0.0