CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1305)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1305)
Severity	Vulnerability	CVE	Installs	Published
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5671	—	Jan 11, 2018
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5365	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5672	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[more_languages] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5366	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5670	—	Jan 11, 2018
High8.8	Cross-Site Request Forgery WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5361	—	Jan 11, 2018
High8.8	Cross-Site Request Forgery SrbTransLatin – Serbian Latinisation≤1.46Update to 1.47	CVE-2018-5368	—	Jan 11, 2018
High8.8	SQL Injection Dbox 3D Slider Lite≤1.2.2Update to 1.2.3	CVE-2018-5374	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting SrbTransLatin – Serbian Latinisation≤1.46Update to 1.47	CVE-2018-5369	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[post_type][page] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5362	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[post_type][post] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5367	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[enabled_languages] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5363	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5364	—	Jan 11, 2018
High8.8	Authenticated SQL Injection Smooth Slider<2.8.7Update to 2.8.7	CVE-2018-5373	—	Jan 10, 2018
High8.8	SQL Injection Testimonial Slider<1.2.5Update to 1.2.5	CVE-2018-5372	—	Jan 10, 2018
Critical9.8	SQL Injection WP Events Calendar Plugin≤1.0Update to 1.1	CVE-2018-5315	—	Jan 9, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5287	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5286	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5293	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5292	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5288	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5290	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5291	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5289	—	Jan 8, 2018
High7.5	Arbitrary File Upload LearnDash LMS<2.5.4Update to 2.5.4	CVE-2018-25019	—	Jan 6, 2018
High7.2	SQL Injection WP Job Board<4.5Update to 4.5	CVE-2018-5695	—	Jan 6, 2018
Medium6.3	Unauthenticated SQL Injection NebulaX Theme<5.0Update to 5.0	CVE-2018-25106	—	Jan 4, 2018
Medium5.4	Stored Cross-Site Scripting Add Link to Facebook≤2.3No patch available	CVE-2018-5214	—	Jan 4, 2018
High8.8	Cross-Site Request Forgery ImageInject≤1.15Update to 1.16	CVE-2018-5285	—	Jan 4, 2018
Medium6.1	Cross-Site Scripting ImageInject≤1.15Update to 1.16	CVE-2018-5284	—	Jan 4, 2018

Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5671Jan 11, 2018
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5365Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5672Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[more_languages]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5366Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5670Jan 11, 2018
High8.8
Cross-Site Request Forgery
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5361Jan 11, 2018
High8.8
Cross-Site Request Forgery
SrbTransLatin – Serbian Latinisation
≤1.46Update to 1.47
CVE-2018-5368Jan 11, 2018
High8.8
SQL Injection
Dbox 3D Slider Lite
≤1.2.2Update to 1.2.3
CVE-2018-5374Jan 11, 2018
Medium4.8
Cross-Site Scripting
SrbTransLatin – Serbian Latinisation
≤1.46Update to 1.47
CVE-2018-5369Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[post_type][page]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5362Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[post_type][post]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5367Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[enabled_languages]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5363Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5364Jan 11, 2018
High8.8
Authenticated SQL Injection
Smooth Slider
<2.8.7Update to 2.8.7
CVE-2018-5373Jan 10, 2018
High8.8
SQL Injection
Testimonial Slider
<1.2.5Update to 1.2.5
CVE-2018-5372Jan 10, 2018
Critical9.8
SQL Injection
WP Events Calendar Plugin
≤1.0Update to 1.1
CVE-2018-5315Jan 9, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5287Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5286Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5293Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5292Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5288Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5290Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5291Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5289Jan 8, 2018
High7.5
Arbitrary File Upload
LearnDash LMS
<2.5.4Update to 2.5.4
CVE-2018-25019Jan 6, 2018
High7.2
SQL Injection
WP Job Board
<4.5Update to 4.5
CVE-2018-5695Jan 6, 2018
Medium6.3
Unauthenticated SQL Injection
NebulaX Theme
<5.0Update to 5.0
CVE-2018-25106Jan 4, 2018
Medium5.4
Stored Cross-Site Scripting
Add Link to Facebook
≤2.3No patch available
CVE-2018-5214Jan 4, 2018
High8.8
Cross-Site Request Forgery
ImageInject
≤1.15Update to 1.16
CVE-2018-5285Jan 4, 2018
Medium6.1
Cross-Site Scripting
ImageInject
≤1.15Update to 1.16
CVE-2018-5284Jan 4, 2018