CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 125)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Board Member+) Comment Author Spoofing
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Insecure Direct Object Reference
kboard
≤6.6Update to 6.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium5.3Unauthenticated Information Exposure
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium5.3Missing Authorization
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
<1.2.0Update to 1.2.0
- Medium4.3Cross-Site Request Forgery
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium4.3Authenticated (Subscriber+) Full Admin Area Denial of Service
Seraphinite Accelerator
≤2.29.23Update to 2.29.24
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Add User Autocomplete
<1.2Update to 1.2
- Medium5.3Unauthenticated Appointment Slot Capacity Bypass
Appointment Hour Booking – Booking Calendar
≤1.5.94Update to 1.5.95
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- High7.3Unauthenticated Privilege Escalation
WP Component
≤2.2.4No patch available
- Medium5.3Unauthenticated Content Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8.0Update to 4.16.8.1
- Medium4.3Cross-Site Request Forgery
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.11Update to 4.2.12
- High8.1Unauthenticated PHP Object Injection
IDB Ecommerce (wpStoreCart 5)
≤5.0.7No patch available
- High7.5Unauthenticated SQL Injection
Album Cover Finder
≤0.7.0No patch available
- Medium4.3Missing Authorization to 2FA Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.1Update to 9.8.2
- Medium5.3Unauthenticated Information Exposure
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Critical9.8Unauthenticated Arbitrary File Upload
DS Ad Rotator
≤0.8No patch available
- Medium6.3Authenticated (Author+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.8Update to 5.2.8
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) SQL Injection
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Remote Code Execution
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.21.5.34 - Unauthenticated Stored Cross-Site Scripting
GenieWords
1.5.27 – 1.5.34No patch available
- High7.2Unauthenticated Arbitrary HTML Injection in Notification Emails
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Critical9.8Unauthenticated Remote Code Execution via Dynamic Render Field Type
Advanced Custom Fields: Extended PRO
≤0.9.2.6Update to 0.9.2.7
- Medium4.38.7.5 - Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
8.7.2 – 8.7.5Update to 8.7.6