CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1244)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.33.3.9 - Missing Authorization Controls to Financial Account Hijacking
Stripe for WooCommerce
3.0.0 – 3.3.9Update to 3.3.10
- Medium6.1Reflected Cross-Site Scripting
Ivory Search – WordPress Search Plugin
≤4.6.6Update to 4.7
- Medium5.3Sensitive Information Disclosure
Credova Financial
≤1.4.8Update to 1.4.9
- Medium5.5Cross-Site Scripting
Download Manager
<3.2.16Update to 3.2.16
- Medium5.4Authenticated Stored Cross Site Scripting
Modern Events Calendar Lite
≤5.22.2Update to 5.22.3
- Medium6.5Missing Authorization
Stylish Price List – Price Table Builder & QR Code Restaurant Menu
≤6.9.0Update to 6.9.1
- Critical9.8Arbitrary Image Upload
Stylish Price List – Price Table Builder & QR Code Restaurant Menu
<6.9.0Update to 6.9.0
- Medium5.5Admin+ Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
<2.6.12Update to 2.6.12
- High8.8Privilege Escalation
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
<1.7.6Update to 1.7.6
- Medium5.5Admin+ Stored Cross Site Scripting
Restaurant Menu and Food Ordering
<2.4.2Update to 2.4.2
- Medium5.4Cross-Site Scripting
WP Reactions Lite
<1.3.6Update to 1.3.6
- Medium5.5Stored Cross-Site Scripting
Flat Preloader
<1.5.5Update to 1.5.5
- Medium5.5Admin+ Stored Cross-Site Scripting
Connections Business Directory
<10.4.3Update to 10.4.3
- High8.8Cross-Site Request Forgery
OG Tags
≤2.0.1Update to 2.0.2
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
Flat Preloader
<1.5.4Update to 1.5.4
- Medium6.4Contributor+ Stored Cross-Site Scripting
Cool Tag Cloud
≤2.25Update to 2.26
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Countdown and CountUp, WooCommerce Sales Timer
≤1.5.7Update to 1.5.8
- Medium4.8Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.5.8.2Update to 3.5.8.2
- Medium4.9Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read
Contact Forms – Drag & Drop Contact Form Builder
≤1.0.5No patch available
- High7.2Admin+ SQL Injection
Permalink Manager Lite
≤2.2.12Update to 2.2.13.1
- Medium5.5Cross-Site Scripting
Contact Forms by Cimatti
<1.4.12Update to 1.4.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Great Quotes
≤1.0.0No patch available
- High7.2Admin+ SQL Injection via Order and OrderBy parameters
Check & Log Email – Easy Email Testing & Mail logging
≤1.0.2Update to 1.0.3
- Medium6.5Unauthenticated Plugin Settings Update
WP Debugging
≤2.10.2Update to 2.11.0
- Medium4.8Admin+ Stored Cross-Site Scripting
Visual Form Builder
≤3.0.3Update to 3.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WP DSGVO Tools (GDPR)
<3.1.24Update to 3.1.24
- High7.2iframe Injection
ark-commenteditor
≤2.15.6No patch available
- Critical9.8Arbitrary File Upload
3DPrint Lite
<1.9.1.5Update to 1.9.1.5
- Medium6.9Multiple Authenticated Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.8Update to 1.4.0
- Medium6.6Authenticated Stored Cross-Site Scripting
AGCA – Custom Dashboard & Login Page
≤6.8Update to 6.9