CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1309)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8PHP Object Injection
Post Pay Counter
<2.731Update to 2.731
- Medium6.1Reflected Cross-site Scripting
Pinfinity
≤1.9.2Update to 2.0
- High8.8Human Resource Management System < 1.1 - SQL Injection
WPHRM – Human Resource Management System for Wordpress | WordPress
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
MC4WP: Mailchimp for WordPress
≤4.1.7Update to 4.1.8
- High7.5Unauthenticated Backup Download
BackWPup – WordPress Backup & Restore Plugin
<3.4.2Update to 3.4.2
- Medium6.1Unauthorized Cross-Site Scripting
Participants Database
≤1.7.5.9Update to 1.7.5.10
- Medium6.1Cross-Site Scripting
SmokeSignal
≤1.2.6Update to 1.2.7
- High8.8Cross-Site Request Forgery
Jayj Quicktag
<1.3.2Update to 1.3.2
- Medium6.1Reflected Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
≤1.1.46Update to 1.1.47
- Medium6.1Reflected Cross-Site Scripting
Share on Diaspora
<0.7.2Update to 0.7.2
- Medium4.7Reflected Cross Site Scripting
Product Vendors
<2.0.36Update to 2.0.36
- Medium6.1Cross-Site Scripting
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.4.0Update to 3.4.0
- High7.2Authenticated SQL Injection via tag_id Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.3.51Update to 1.3.51
- Medium6.1Cross-Site Scripting
WP Job Board
≤4.5.1Update to 5.0
- Medium6.1Cross-Site Scripting
Embed Images in Comments
<0.6Update to 0.6
- Medium6.1Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
<1.1.47Update to 1.1.47
- Medium5.4Stored Cross-Site Scripting
UpdraftPlus Premium
≤1.13.4Update to 1.13.5
- Critical9.8Blind SQL Injection
Loginizer
<1.3.6Update to 1.3.6
- Medium6.1Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting
Bridge - Creative Multipurpose WordPress Theme
<11.2Update to 11.2
- High8.8Cross-Site Request Forgery
Loginizer
<1.3.6Update to 1.3.6
- High8.0Authenticated SQL Injection
Podlove Podcast Publisher
<2.6.0Update to 2.6.0
- High7.2SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
- Medium6.1Cross-Site Scripting
PressForward
<5.2.4Update to 5.2.4
- High7.2Authenticated (Admin+) SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
- High8.8SQL Injection
RK Responsive Contact Form
≤1.0.0No patch available
- Medium6.1Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting
Gameplan - Event and Gym Fitness WordPress Theme
≤1.6.4No patch available
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.1.04Update to 7.1.05
- Critical9.8SQL Injection
Ultimate Product Catalog
≤4.2.22Update to 4.2.23
- Medium6.1Cross-Site Scripting
Ultimate Product Catalog
≤4.2.11Update to 4.2.12
- Medium6.1Cross-Site Scripting
Easy Testimonials
≤3.0.4No patch available