CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 13)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress plugins- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter
LearnPress – Course Review
≤4.2.2Update to 4.2.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.3.2Update to 11.0.0
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint
MotoPress Appointment Booking
≤2.4.8Update to 2.4.9
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Email Field
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.6Update to 5.7.7
- Medium5.3Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter
Jupiter X Core
≤4.62.0Update to 4.63.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review
Kubio AI Page Builder
≤2.9.4Update to 2.9.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name
WPBakery Page Builder
≤9.0.1Update to 9.1
- Medium5.9Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter
Jupiter X Core
≤4.62.0Update to 4.63.0
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta
Jupiter X Core
≤4.62.0Update to 4.63.0
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title
JS Help Desk – AI-Powered Support & Ticketing System
≤5.0.2Update to 5.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤3.13.6Update to 3.13.7
- High8.8Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json
Interactive Real Estate – Floor Plan & Building Visualizer
≤2.6.0Update to 2.6.1
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix
Greenshift – animation and page builder blocks
≤13.2.2Update to 13.2.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.3.8Update to 2.3.9
- Medium5.3Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter
Greenshift – animation and page builder blocks
≤13.2.2Update to 13.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.200Update to 2.8.201
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content
FV Flowplayer Video Player
≤7.5.56.7212Update to 7.5.57.7212
- Medium5.4Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.50Update to 1.15.51
- Low3.7Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.4.7Update to 2.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.50Update to 1.15.51
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.17Update to 1.8.18
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.12.2Update to 9.12.3
- Medium5.3Missing Authorization
Advanced Appointment Booking & Scheduling
≤2.6Update to 2.7
- Critical9.8Unauthenticated Arbitrary File Upload
WP Duplicate – WordPress Migration Plugin
≤1.1.11No patch available
- Medium4.3Missing Authorization
GemBooking – Appointment Booking, Booking Calendar & Reservations
≤1.7.0Update to 1.7.1
- Medium5.3Unauthenticated Team Member Double-Booking
GemBooking – Appointment Booking, Booking Calendar & Reservations
≤1.7.0Update to 1.7.1
- Medium4.3Two-Factor Authentication Bypass
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
≤2.10.0Update to 2.11.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Fusion Page Builder
≤1.7.0Update to 1.7.1
- Medium4.3Missing Authorization
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
≤4.2.0Update to 4.3.1