CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 124)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
PuppyFW
≤0.4.4No patch available
- Critical9.8Unauthenticated Remote Code Execution
wpShopGermany IT-RECHT KANZLEI
≤2.3Update to 2.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Dictionary
≤1.0No patch available
- Medium4.32.5.3 - Authenticated (Author+) Information Exposure
Comments Import & Export
2.1.11 – 2.5.3Update to 2.5.4
- Medium5.3Missing Authorization
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- Medium5.3Unauthenticated Information Exposure
Newsletter
≤9.3.7Update to 9.3.8
- Medium6.43.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
3.2.0 – 3.2.5Update to 3.2.6
- Critical9.8Unauthenticated Privilege Escalation
Choose User Role at Registration for WooCommerce
≤1.3.2Update to 1.3.3
- High7.3Unauthenticated Arbitrary Account Takeover
Headless SSO Plugin for WP
≤1.7.0Update to 1.7.1
- Medium5.3Unauthenticated Information Exposure
EduAdmin Booking
≤5.4.2Update to 6.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
Job Postings
≤2.8.1Update to 2.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics pro
≤11.21Update to 11.22
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Inventory Manager
≤2.5.4Update to 2.5.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.7Update to 3.7.8
- Medium5.3Unauthenticated Sensitive Information Exposure in 'id' Parameter
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
≤1.16.20Update to 1.16.21
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.15.0Update to 4.16.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets
≤4.9.5Update to 4.9.6
- Medium5.3Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
JWT Authentication for WP REST APIs
≤4.7.0Update to 4.8.0
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤4.1.0Update to 4.2.0
- High8.8Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
Consulting - Business, Finance WordPress Theme
≤6.7.16Update to 6.7.17
- Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.4Unauthenticated Open Redirect
Newsletter
≤9.3.6Update to 9.3.7
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24