CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1289)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.2Update to 4.0.2
- High8.8Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤5.6Update to 5.6.1
- High8.8Cross-Site Request Forgery
Contact Form Email
≤1.2.65Update to 1.2.66
- High8.8Unauthenticated HTML Injection & Cross-Site Request Forgery
cformsII
<15.0.2Update to 15.0.2
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.88Update to 2.0.4
- Medium6.1Cross-Site Scripting
Contact Form Email
≤1.2.65Update to 1.2.66
- Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.0Update to 2.5.1
- High8.8Cross-Site Request Forgery
Social Feed Gallery
<2.4.8Update to 2.4.8
- Medium4.3Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- Medium6.1Missing Authentication on Option Changes
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
<18.4Update to 18.4
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Social LikeBox & Feed
≤2.8.4Update to 2.8.5
- High7.2Missing Authorization
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- High8.8Cross-Site Request Forgery to Remote Code Execution
WP SVG Icons
<3.2.3Update to 3.2.3
- Critical9.8PHP Object Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.02.01Update to 4.02.01
- High7.5Arbitrary Post Deletion
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
≤2.2.5Update to 2.2.6
- Critical9.8Options Change
Restaurant Reservations
≤1.3Update to 1.5
- High8.8< 2.3 - Cross-Site Request Forgery
Pricing Table Plugin
<2.3Update to 2.3
- Medium6.1Unauthenticated Settings Update
Login or Logout Menu Item
<1.2.0Update to 1.2.0
- Critical9.8SQL Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.44Update to 3.45
- Medium6.1Open Redirect
Learning Courses
≤4.7Update to 4.8
- Critical9.6Unauthenticated Arbitrary Options Update
Hotel Booking
<2.5Update to 2.5
- Medium6.1Open Redirect
Travel Management
≤1.6.1Update to 1.7
- High8.2Unauthenticated Arbitrary Options Change
Donations
<1.4Update to 1.4
- High8.8Missing Authorization to Settings Import
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.2.5Update to 2.2.5
- Medium6.1Unauthenticated WordPress Options Update
ND Shortcodes
<6.0Update to 6.0
- Critical9.8SQL Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
<3.4Update to 3.4
- Critical9.1Directory Traversal
WP Fastest Cache – WordPress Cache Plugin
≤0.8.9.5Update to 0.8.9.6
- High8.8Cross-Site Request Forgery
Simple Membership
<3.8.5Update to 3.8.5