VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 131)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 131)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Aruba HiSpeed Cache≤3.0.14Update to 3.0.15
CVE-2026-15889—
Medium6.1Reflected Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.46Update to 1.15.47
CVE-2026-85645—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
Easy Google Fonts≤2.0.4No patch available
CVE-2026-4657—
Medium4.3Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'
Advanced Contact form 7 DB≤2.1.3No patch available
CVE-2026-18594—
Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
WP BackItUp Community Edition≤2.1.0No patch available
CVE-2026-18386—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
Builderall for WordPress≤3.0.2No patch available
CVE-2026-15823—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
Builderall for WordPress≤3.0.2No patch available
CVE-2026-15820—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
Builderall for WordPress≤3.0.2No patch available
CVE-2026-15796—
High7.2Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
Sidebar Manager Light≤1.18No patch available
CVE-2026-76562—
High8.0Authenticated (Subscriber+) Arbitrary Password Reset
Bulk Password Reset≤1.3.3No patch available
CVE-2026-14873—
High7.5Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Direct Download for WooCommerce≤1.19No patch available
CVE-2026-15019—
Critical9.8Unauthenticated Arbitrary File Upload via 'type' Parameter
Drag and Drop File Upload for Elementor Forms≤1.6.0Update to 1.6.1
CVE-2026-183511K+
High7.5Unauthenticated SQL Injection
Verified Reviews (Avis Vérifiés)≤2.4.6No patch available
CVE-2026-81800—
High8.8Authenticated (Subscriber+) Remote Code Execution
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress≤4.1224Update to 4.1225
CVE-2026-81803—
Medium5.3Unauthenticated Email Header Injection
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor<4.1.9Update to 4.1.9
CVE-2026-86813—
Medium5.3Missing Authorization
WP Fast Total Search – The Power of Indexed Search≤1.82.284Update to 1.83.286
CVE-2026-84821—
Medium5.36.2.5 - Unauthenticated Information Exposure
Kirki – Freeform Page Builder, Website Builder & Customizer6.2.1 – 6.2.5Update to 6.3.0
CVE-2026-84222—
Medium5.32.3.3 - Unauthenticated Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates1.3.1 – 2.3.3Update to 3.4.0
CVE-2026-82848—
Medium5.3Missing Authorization
BuddyForms≤2.9.0No patch available
CVE-2026-81785—
Medium5.33.5.2 - Unauthenticated Information Exposure
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot3.3.6 – 3.5.2Update to 3.5.3
CVE-2026-81022—
Medium5.3Missing Authorization
Robokassa payment gateway for Woocommerce≤1.8.9Update to 1.9.0
CVE-2026-78536—
Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Advanced Customized Prompts≤1.0.1No patch available
CVE-2026-14563—
Medium5.3Unauthenticated Information Exposure
Teddy Bear Customize Addon≤1.0.5No patch available
CVE-2026-14562—
Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Teddy Bear Customize Addon≤1.0.5No patch available
CVE-2026-14559—
Medium6.41.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Content Mask1.7.1 – 1.8.5.5Update to 1.8.5.6
CVE-2025-15690—
Medium5.32.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion
المنتور فارسی2.7.10 – 2.8.1Update to 2.8.2
CVE-2026-86809—
High7.2Unauthenticated Stored Cross-Site Scripting
WPCS – WordPress Currency Switcher Professional≤1.3.2Update to 1.3.3
CVE-2026-84816—
Medium5.3IP Soofing
IP2Location Country Blocker≤2.44.0Update to 2.45.0
CVE-2026-82530—
High7.3Unauthenticated Privilege Escalation
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP≤2.1.5Update to 2.1.6
CVE-2026-81805—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Docs≤2.3.3Update to 2.3.4
CVE-2026-81782—

Search VulnCrest Radar

Jump to

Are you sure?