CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1245)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated Stored Cross-Site Scripting
iQ Block Country
≤1.2.11Update to 1.2.12
- Medium6.4Unprotected REST-API to Email Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium6.5Unprotected REST-API to Sensitive Information Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- High7.5Arbitrary User Password Reset
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.6.2Update to 2.6.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Cookie Bar
≤1.8.8Update to 1.8.9
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
Easy Media Download
≤1.1.5Update to 1.1.7
- Medium5.8Open Relay and Server-Side Request Forgery
Telefication
≤1.8.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Responsive WordPress Slider
≤2.2.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Special Text Boxes
≤5.9.109Update to 5.9.110
- Medium4.8Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
Video Gallery – Vimeo and YouTube Gallery
<1.1.5Update to 1.1.5
- High8.8Cross-Site Request Forgery
jQuery Reply to Comment
≤1.31No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
St-Daily-Tip
≤4.7No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Frontend Uploader
≤1.3.2No patch available
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
WP HTML Author Bio
≤1.2.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Game Server Status
≤1.0No patch available
- High7.5Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR)
≤3.1.23Update to 3.1.24
- Medium4.8Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.5Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.0Update to 2.6.1
- Medium6.1Reflected Cross-Site Scripting
GamePress – The Game Database Plugin
≤1.1.0No patch available
- Medium6.5Cross-Site Request Forgery to Cross-Site Scripting
Wp Cookie Choice
≤1.1.0No patch available
- Medium5.4Missing Authorization
Catch Themes Demo Import
<1.6Update to 1.6
- Medium6.4Cross-Site Scripting
Easy Feeds for X/Twitter – keep your site fresh with live social posts
<1.2Update to 1.2
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available
- Medium6.5Cross-Site Request Forgery
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- High7.2Admin+ SQL Injection
MainWP Child Reports
≤2.0.7Update to 2.0.8
- Critical9.8Authentication Bypass via Password Reset
YITH Easy Login & Register Popup for WooCommerce
≤1.8.0Update to 1.8.1
- Medium5.4Cross-Site Scripting
PDF Viewer Block for Gutenberg
<1.0.1Update to 1.0.1
- Medium6.4Contributor+ Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.1.2Update to 2.1.3