CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1263)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Unauthenticated Stored Cross-Site Scripting
DSGVO All in one for WP
≤3.9Update to 4.0
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.20Update to 2.1.20
- High7.3Missing Authorization
Product Filter for WooCommerce by WBW
≤1.4.9Update to 1.5.0
- Medium6.1Reflected Cross-Site Scripting
Product Slider, Product Grid, Product Masonry
≤1.13.21Update to 1.13.22
- Medium6.4Authenticated Stored Cross-Site Scripting
Hana Flv Player
≤3.1.3No patch available
- Medium6.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- High8.8Authenticated (Contributor+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- Medium6.1Stored Cross-Site Scripting
Watcheezy Live chat plugin for WordPress
≤2.0Update to 3.0
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Customer Reviews
≤3.5.5Update to 3.5.6
- Medium6.1Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Hotjar Connecticator
≤1.1.1No patch available
- Low3.8Authenticated (Admin+) Cross-Site Scripting
WP YouTube Lyte
<1.7.16Update to 1.7.16
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.10.4Update to 2.10.4
- Critical10.0Remote Code Execution
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Open Redirect
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
<7.5.0Update to 7.5.0
- Medium5.3Denial of Service
WPGraphQL
≤1.3.5Update to 1.3.6
- Medium6.5Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.1.7Update to 0.9.1.7
- Medium6.4Stored Cross-Site Scripting
Happy Addons for Elementor Pro
<1.17.0Update to 1.17.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Store Locator Plus® for WordPress
≤5.12.3Update to 5.13.8
- Critical9.8Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
Car Seller – Auto Classifieds Script
≤2.1.0No patch available
- Critical9.8Tour & Travel WordPress Theme < 2.1 - SQL Injection
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- High8.8Authenticated Privilege Escalation
Store Locator Plus® for WordPress
≤5.5.15Update to 5.7
- Medium4.8Admin+ Stored Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium4.8Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Redirect 404 to parent
<1.3.1Update to 1.3.1
- Medium5.3Arbitrary Options Update
Thrive Leads
<2.3.9.4Update to 2.3.9.4
- Medium6.1Reflected Cross-Site Scripting
Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
<1.3.2Update to 1.3.2
- Medium5.5Admin+ Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.30Update to 1.31
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Captchinoo, admin login page protection with Google recaptcha
≤2.3Update to 2.4