CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1242)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Admin+ SQL injection
Affiliates Manager
≤2.8.6Update to 2.8.7
- Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
≤3.7.1.4Update to 3.7.1.5
- Medium5.5Stored Cross-Site Scripting
Qwizcards | online quizzes and flashcards
≤3.61Update to 3.62
- High8.8SQL Injection
School Management System – WPSchoolPress
<2.1.10Update to 2.1.10
- Medium4.3wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
Comments – wpDiscuz
<7.3.4Update to 7.3.4
- High7.2Admin+ Arbitrary PHP Code Execution
Similar Posts – Best Related Posts Plugin for WordPress
≤3.1.5Update to 3.1.6
- Medium6.5Logs Deletion via Cross-Site Request Forgery
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<3.0.9Update to 3.0.9
- Medium5.3Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass
Squaretype - Modern Blog WordPress Theme
<3.0.4Update to 3.0.4
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Storefront Footer Text
≤1.0.1No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Tool Lite
≤2.3.15No patch available
- High8.8Cross-Site Request Forgery
WP SEO Redirect 301
<2.3.2Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting
WP Header Images
<2.0.1Update to 2.0.1
- High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress
<1.3.3Update to 1.3.3
- Medium6.5Authenticated PHP Code Injection
Loco Translate
<2.5.4Update to 2.5.4
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Comment Engine Pro
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Post Content XMLRPC
≤1.0No patch available
- Medium6.4Agent+ Stored Cross-Site Scripting
Support Board
≤3.3.4Update to 3.3.5
- High8.8Cross-Site Request Forgery
Chameleon CSS
≤1.2No patch available
- High8.8Authenticated (Author+) SQL Injection
Schreikasten
≤0.14.18No patch available
- High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style
≤3.1.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
Unlimited PopUps
≤4.5.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink
≤1.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog
≤1.7.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival
≤1.4.2Update to 1.4.3
- High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics
≤3.8Update to 3.9
- Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
<1.3.1Update to 1.3.1
- Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename
≤3.4.2Update to 3.4.4
- Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<5.0.07Update to 5.0.07
- Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs
≤1.7.8Update to 1.7.9
- Medium4.3Cross-Site Request Forgery
Genie WP Favicon
≤0.5.2No patch available