CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1308)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1308)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Raygun≤1.8.2Update to 1.8.3	CVE-2017-18531	—	Oct 5, 2017
High8.8	Cross-Site Request Forgery Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager≤3.0.9Update to 3.1.0	CVE-2017-18510	—	Oct 4, 2017
Critical9.8	Custom Registration Forms <= 3.7.9.2 - PHP Object Injection RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login<3.7.9.3Update to 3.7.9.3	CVE-2017-20208	—	Oct 2, 2017
Medium6.1	Cross-Site Scripting PDF Invoices & Packing Slips for WooCommerce<2.0.13Update to 2.0.13	CVE-2017-18506	—	Oct 2, 2017
Critical9.8	Unauthenticated PHP Object Injection Appointments<2.2.2Update to 2.2.2	CVE-2017-20206	—	Oct 2, 2017
Critical9.8	Unauthenticated PHP Object Injection Flickr Gallery<1.5.3Update to 1.5.3	CVE-2017-20207	—	Oct 2, 2017
Medium6.5	Authenticated Directory Traversal Insert Pages<3.2.4Update to 3.2.4	CVE-2017-18586	—	Sep 29, 2017
High8.8	SQL Injection Hospital Management System for Wordpress≤08-03-2018Update to 22-05-2018	CVE-2017-14846	—	Sep 26, 2017
High8.8	Wordpress Gym Management System (Unknown Version) - SQL Injection WPGYM - Wordpress Gym Management Systemall versionsNo patch available	CVE-2017-14844	—	Sep 26, 2017
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Content Audit≤1.9.1Update to 1.9.2	CVE-2017-18560	—	Sep 26, 2017
Critical9.8	SQL Injection content_timeline≤4.4.2Update to 4.4.3	CVE-2017-14507	—	Sep 26, 2017
High8.8	Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection WPAMS - Apartment Management System for wordpress<17-07-2019Update to 17-07-2019	CVE-2017-14847	—	Sep 26, 2017
High8.8	Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection WPCHURCH - Church Management System for Wordpress<13-07-2019Update to 13-07-2019	CVE-2017-14845	—	Sep 26, 2017
High8.8	Authenticated SQL Injection SMSmaster – Multipurpose SMS Gateway for Wordpressall versionsNo patch available	CVE-2017-14842	—	Sep 26, 2017
High8.8	Authenticated (Student+) SQL Injection School Management System for Wordpressall versionsNo patch available	CVE-2017-14843	—	Sep 26, 2017
Medium6.1	Cross-Site Scripting WP Jobs<1.7Update to 1.7	CVE-2017-14751	—	Sep 26, 2017
Critical9.8	SQL Injection Gallery – Image and Video Gallery with Thumbnails<1.2.1Update to 1.2.1	CVE-2017-14125	—	Sep 22, 2017
Medium5.3	Directory Traversal Smush – Image Optimization, Compression, Lazy Load, WebP & CDN≤2.7.5Update to 2.7.6	CVE-2017-15079	—	Sep 21, 2017
Critical9.8	Authentication Bypass Student Result or Employee Database≤1.6.3Update to 1.6.4	CVE-2017-14766	—	Sep 21, 2017
Medium6.1	Reflected Cross-Site Scripting 2kb Amazon Affiliates Store<2.1.1Update to 2.1.1	CVE-2017-14622	—	Sep 20, 2017
Low3.5	Open Redirect in Admin Dashboard WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14725	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Shortcodes WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14726	—	Sep 19, 2017
Medium4.9	Directory Traversal via Customizer WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14722	—	Sep 19, 2017
Medium4.3	Directory Traversal during unzip WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14719	—	Sep 19, 2017
Critical9.8	SQL Injection via Mishandled Placeholders WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14723	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Template Name WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14720	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Javascript: and Data: URLs WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14718	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting in oEmbed WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14724	—	Sep 19, 2017
Medium5.5	Stored Cross-Site Scripting via Plugin Names WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14721	—	Sep 19, 2017
High7.5	Arbitrary Settings Change Post Pay Counter<2.731Update to 2.731	CVE-2017-18584	—	Sep 16, 2017

Medium6.1
Cross-Site Scripting
Raygun
≤1.8.2Update to 1.8.3
CVE-2017-18531Oct 5, 2017
High8.8
Cross-Site Request Forgery
Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager
≤3.0.9Update to 3.1.0
CVE-2017-18510Oct 4, 2017
Critical9.8
Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<3.7.9.3Update to 3.7.9.3
CVE-2017-20208Oct 2, 2017
Medium6.1
Cross-Site Scripting
PDF Invoices & Packing Slips for WooCommerce
<2.0.13Update to 2.0.13
CVE-2017-18506Oct 2, 2017
Critical9.8
Unauthenticated PHP Object Injection
Appointments
<2.2.2Update to 2.2.2
CVE-2017-20206Oct 2, 2017
Critical9.8
Unauthenticated PHP Object Injection
Flickr Gallery
<1.5.3Update to 1.5.3
CVE-2017-20207Oct 2, 2017
Medium6.5
Authenticated Directory Traversal
Insert Pages
<3.2.4Update to 3.2.4
CVE-2017-18586Sep 29, 2017
High8.8
SQL Injection
Hospital Management System for Wordpress
≤08-03-2018Update to 22-05-2018
CVE-2017-14846Sep 26, 2017
High8.8
Wordpress Gym Management System (Unknown Version) - SQL Injection
WPGYM - Wordpress Gym Management System
all versionsNo patch available
CVE-2017-14844Sep 26, 2017
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Content Audit
≤1.9.1Update to 1.9.2
CVE-2017-18560Sep 26, 2017
Critical9.8
SQL Injection
content_timeline
≤4.4.2Update to 4.4.3
CVE-2017-14507Sep 26, 2017
High8.8
Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection
WPAMS - Apartment Management System for wordpress
<17-07-2019Update to 17-07-2019
CVE-2017-14847Sep 26, 2017
High8.8
Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection
WPCHURCH - Church Management System for Wordpress
<13-07-2019Update to 13-07-2019
CVE-2017-14845Sep 26, 2017
High8.8
Authenticated SQL Injection
SMSmaster – Multipurpose SMS Gateway for Wordpress
all versionsNo patch available
CVE-2017-14842Sep 26, 2017
High8.8
Authenticated (Student+) SQL Injection
School Management System for Wordpress
all versionsNo patch available
CVE-2017-14843Sep 26, 2017
Medium6.1
Cross-Site Scripting
WP Jobs
<1.7Update to 1.7
CVE-2017-14751Sep 26, 2017
Critical9.8
SQL Injection
Gallery – Image and Video Gallery with Thumbnails
<1.2.1Update to 1.2.1
CVE-2017-14125Sep 22, 2017
Medium5.3
Directory Traversal
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤2.7.5Update to 2.7.6
CVE-2017-15079Sep 21, 2017
Critical9.8
Authentication Bypass
Student Result or Employee Database
≤1.6.3Update to 1.6.4
CVE-2017-14766Sep 21, 2017
Medium6.1
Reflected Cross-Site Scripting
2kb Amazon Affiliates Store
<2.1.1Update to 2.1.1
CVE-2017-14622Sep 20, 2017
Low3.5
Open Redirect in Admin Dashboard
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14725Sep 19, 2017
Medium6.4
Cross-Site Scripting via Shortcodes
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14726Sep 19, 2017
Medium4.9
Directory Traversal via Customizer
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14722Sep 19, 2017
Medium4.3
Directory Traversal during unzip
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14719Sep 19, 2017
Critical9.8
SQL Injection via Mishandled Placeholders
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14723Sep 19, 2017
Medium6.4
Cross-Site Scripting via Template Name
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14720Sep 19, 2017
Medium6.4
Cross-Site Scripting via Javascript: and Data: URLs
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14718Sep 19, 2017
Medium6.4
Cross-Site Scripting in oEmbed
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14724Sep 19, 2017
Medium5.5
Stored Cross-Site Scripting via Plugin Names
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14721Sep 19, 2017
High7.5
Arbitrary Settings Change
Post Pay Counter
<2.731Update to 2.731
CVE-2017-18584Sep 16, 2017