CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1283)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.82.6.7.6 - PHP Object Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
2.2.8 – 2.6.7.6Update to 3.0
- High8.1Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.3Update to 4.6.0.3
- Medium6.4Authenticated Stored Cross-Site Scripting and Authorization Bypass
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
≤1.8.2Update to 1.8.3
- High7.5SQL Injection
Participants Database
<1.9.5.6Update to 1.9.5.6
- High7.5Unauthenticated Information Disclosure
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.5Update to 5.5.1
- Medium6.38.6 - Missing Authorization Checks
Indeed Membership Pro
7.3 – 8.6Update to 8.6.1
- Critical9.88.6 - Authentication Bypass
Indeed Membership Pro
7.3 – <8.6.1Update to 8.6.1
- High8.0Authenticated (Subscriber+) Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.0.3Update to 0.9.0.3
- High8.8Cross-Site Request Forgery
Tutor LMS – eLearning and online course solution
<1.5.3Update to 1.5.3
- Medium6.4Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.23Update to 3.4.23
- High8.8Cross-Site Request Forgery
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
≤1.8.1Update to 1.8.2
- Medium6.1Stored Cross Site Scripting
Strong Testimonials
≤2.40.0Update to 2.40.1
- High8.0Authenticated (Author+) CSV Injection
TablePress – Tables in WordPress made easy
≤1.14Update to 2.0
- Medium6.13.11.2 - Cross-Site Scripting
Login by Auth0
3.11.0 – 3.11.2Update to 3.11.3
- Medium6.4Cross-Site Scripting
gistpress
<3.0.2Update to 3.0.2
- Medium6.1Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.1Update to 4.6.0.3
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.4Update to 2.8.5
- High8.8Cross-Site Request Forgery to Remote Code Execution
Code Snippets
≤2.13.3Update to 2.14.0
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
≤4.8.83Update to 4.8.84
- Critical9.8Authentication Bypass
Wordable – Export Google Docs to WordPress
<3.1.2Update to 3.1.2
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.5.4.2Update to 1.5.5
- Medium5.4Authenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.0.353Update to 1.0.354
- Medium6.1Cross-Site Scripting
Chatbot with IBM watsonx Assistant
<0.8.21Update to 0.8.21
- Medium5.3Insecure Direct Object Reference via order_id Parameter
WooCommerce
<4.7.0Update to 4.7.0
- Critical9.8Arbitrary Code Execution
AccessAlly
<3.3.2Update to 3.3.2
- Medium5.4Authorization Bypass
Slideshow, Image Slider by 2J
≤1.3.31Update to 1.3.33
- High7.2Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.3Update to 2.8.4
- High8.8Cross-Site Request Forgery
Marketo Forms and Tracking
≤1.0.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Chained Quiz
<1.1.8.2Update to 1.1.8.2
- Critical9.1Unauthenticated Database Reset
Database Reset
≤3.1Update to 3.15