CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1288)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2019-16118 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16117 | — | |
| Critical9.8 | SQL Injection | CVE-2019-16119 | — | |
| High7.5 | Arbitrary Settings Change | CVE-2019-15895 | — | |
| High7.2 | Stored Cross-Site Scripting via Comments WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16218 | — | |
| Medium5.4 | Reflected Cross-Site Scripting via Shortcode Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16219 | — | |
| Medium6.4 | Cross-Site Scripting via Media Uploads WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16217 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting via Post Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16223 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16221 | — | |
| Medium6.4 | Stored Cross-Site Scripting via Comments via URLs WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16222 | — | |
| Medium4.6 | Open Redirect WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16220 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16332 | — | |
| High8.8 | CSV Injection | CVE-2019-16120 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-1010124 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2019-15777 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15769 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14314 | 300K+ | |
| High7.5 | Unauthenticated Settings Change | CVE-2019-15816 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9352 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14470 | — | |
| Medium5.3 | Improper Input Validation | CVE-2019-14978 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15770 | — | |
| High7.5 | Missing Authorization to Settings Update | CVE-2019-15821 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-15778 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18564 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14774 | — | |
| High7.5 | Missing Authorization Checks | CVE-2015-9331 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-15817 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10895 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10887 | — |
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.34Update to 1.5.35
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- High7.5Arbitrary Settings Change
Search Exclude
<1.2.4Update to 1.2.4
- High7.2Stored Cross-Site Scripting via Comments
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium5.4Reflected Cross-Site Scripting via Shortcode Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Cross-Site Scripting via Media Uploads
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium5.4Authenticated Cross-Site Scripting via Post Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Stored Cross-Site Scripting via Comments via URLs
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium4.6Open Redirect
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Cross-Site Scripting
API Bearer Auth
<20190907Update to 20190907
- High8.8CSV Injection
Event Tickets and Registration
≤4.10.7.1Update to 4.10.7.2
- Medium6.1Reflected Cross-Site Scripting
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤3.1.14Update to 3.1.15
- Medium5.4Cross-Site Scripting
WP DSGVO Tools (GDPR)
<2.2.19Update to 2.2.19
- High8.8Cross-Site Request Forgery
HandL UTM Grabber / Tracker
<2.6.5Update to 2.6.5
- Critical9.8SQL Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<3.2.11Update to 3.2.11
- High7.5Unauthenticated Settings Change
WP Private Content Plus
≤1.31Update to 2.0
- Critical9.8SQL Injection
WP-Polls
≤2.71Update to 2.72
- Medium6.1Reflected Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.34Update to 4.9.35.1
- Medium5.3Improper Input Validation
WooCommerce PayU India (PayUmoney – PayUbiz)
≤2.1.1No patch available
- High8.8Cross-Site Request Forgery
Address Book for WooCommerce
<1.6.0Update to 1.6.0
- High7.5Missing Authorization to Settings Update
Bold Page Builder
≤2.3.1Update to 2.3.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Additional Variation Images Gallery for WooCommerce
<1.1.29Update to 1.2.29
- Medium6.1Reflected Cross-Site Scripting
Sender by BestWebSoft
≤1.2.0Update to 1.2.1
- Medium6.1Reflected Cross-Site Scripting
Variation Swatches for WooCommerce
<1.0.62Update to 1.0.62
- High7.5Missing Authorization Checks
WP All Import Pro
<4.1.1Update to 4.1.1
- Medium6.1Cross-Site Scripting
Easy Property Listings
≤3.3.3Update to 3.4
- Medium6.1Cross-Site Scripting
OptionTree
≤2.5.5Update to 2.6
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.9Update to 4.0.9