CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1270)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Settings Import & Export
Ultimate GDPR & CCPA Compliance Toolkit for WordPress
<2.5Update to 2.5
- High8.8Contact Form 7 Style <= 3.1.9 Cross-Site Request Forgery
Contact Form 7 Style
≤3.1.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.68Update to 1.5.68
- High8.8SQL Injection
wpDataTables (Premium)
≤3.4Update to 3.4.1
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.1.9Update to 3.2.0
- Medium6.1Reflected Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.73Update to 3.74
- High7.2Authenticated (Admin+) SQL injection
WP Editor
≤1.2.6.3Update to 1.2.7
- High7.2Authenticated Arbitrary File Upload leading to Remote Code Execution
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High8.8Authenticated SQL Injection
Modern Events Calendar Lite
≤5.16.5Update to 5.16.6
- Medium6.4Authenticated Stored Cross-Site Scripting
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High7.5Unauthenticated Events Export
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High7.5Unauthenticated Information Disclosure
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Creation
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Wordpress Options Changes via AJAX
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Changes
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.1Unauthenticated Arbitrary Post/Page Deletion
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Medium6.5Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Options Changes via wp_route
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.6Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.09.05Update to 4.09.05
- Critical9.8Missing Authorization
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Arbitrary File Upload
YITH WooCommerce Gift Cards Premium
<3.3.1Update to 3.3.1
- High8.8CSV Injection
Database Addon for Contact Form 7 – CFDB7
<1.2.5.6Update to 1.2.5.6
- Medium6.5Information Disclosure
Doneren met Mollie
≤2.8.4Update to 2.8.5
- Medium6.1Reflected Cross-Site Scripting
Advanced Custom Fields Pro
<5.9.1Update to 5.9.1
- High7.2Easy Redirect Manager < 2.51 - SQL Injection
301 Redirects – Redirect Manager
<2.51Update to 2.51
- Medium6.1Reflected Cross-Site Scripting
WP Shieldon – WordPress Firewall
≤1.6.3Update to 1.6.4
- Critical9.8Incorrect Permission Assignment or Protection
WP Editor
<1.2.6Update to 1.2.6
- Medium5.4Authenticated Stored Cross-Site Scripting
Easy Contact Form Pro
<1.1.1.9Update to 1.1.1.9
- Medium5.4Authenticated Stored Cross-Site Scripting via Menu Label field
Pods – Custom Content Types and Fields
2.4.4.2 – 2.7.26Update to 2.7.27
- Medium5.42.7.26 - Authenticated Stored Cross-Site Scripting
Pods – Custom Content Types and Fields
2.4.4.1 – <2.7.27Update to 2.7.27