CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1312)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1312)
Severity	Vulnerability	CVE	Installs	Published
High7.5	Directory Traversal Task Scheduler≤1.6.0Update to 1.6.1	CVE-2017-1000170	—	May 8, 2017
Medium5.9	Unauthorized Password Reset via Interception WordPress<5.5Update to 5.5	CVE-2017-8295	—	May 3, 2017
Medium6.1	Cross-Site Scripting cformsII≤14.13.2Update to 14.13.3	CVE-2017-18559	—	Apr 28, 2017
Critical9.8	Object Injection Gravitate QA Tracker≤1.2.1No patch available	CVE-2017-18605	—	Apr 27, 2017
Critical9.8	PHP Object Injection SiteBuilder Dynamic Components≤1.0No patch available	CVE-2017-18604	—	Apr 27, 2017
Critical9.8	Arbitrary file upload flickr-picture-backup≤0.7No patch available	CVE-2017-1002016	—	Apr 26, 2017
Medium6.1	Cross-Site Scripting Jetpack – AI Agents & MCP, Security, Backup & Analytics<4.0.3Update to 4.0.3	CVE-2016-10706	—	Apr 26, 2017
High8.8	Cross-Site Request Forgery Avada \| Website Builder For WordPress & WooCommerce<5.1.5Update to 5.1.5	CVE-2017-18607	—	Apr 26, 2017
Medium6.1	Stored Cross-Site Scripting Avada \| Website Builder For WordPress & WooCommerce<5.1.5Update to 5.1.5	CVE-2017-18606	—	Apr 26, 2017
High7.2	Authenticated SQL Injection cformsII<14.13Update to 14.13	CVE-2017-18570	—	Apr 24, 2017
Medium6.1	Reflected Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred<1.7.8Update to 1.7.8	CVE-2017-20008	—	Apr 20, 2017
Critical9.8	Arbitrary File Upload CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce≤3.0.5Update to 3.1.0	CVE-2017-18592	—	Apr 20, 2017
Medium6.1	Cross-Site Scripting Spot.IM Comments<4.0.4Update to 4.0.4	CVE-2017-18608	—	Apr 19, 2017
Medium6.1	Reflected Cross-Site Scripting Simple Job Board<2.4.4Update to 2.4.4	CVE-2017-18498	—	Apr 19, 2017
Medium6.1	Reflected Cross-Site Scripting Timesheet by BestWebSoft<0.1.5Update to 0.1.5	CVE-2017-18590	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Rating by BestWebSoft<0.2Update to 0.2	CVE-2017-18530	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website<1.1.1Update to 1.1.1	CVE-2017-18529	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Error Log Viewer by BestWebSoft<1.0.6Update to 1.0.6	CVE-2017-18562	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Realty by BestWebSoft<1.1.0Update to 1.1.0	CVE-2017-18532	—	Apr 17, 2017
Medium6.1	Cross-Site Scripting BestWebSoft's LinkedIn<1.0.5Update to 1.0.5	CVE-2017-18516	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Social Buttons Pack by BestWebSoft<1.1.1Update to 1.1.1	CVE-2017-18500	—	Apr 17, 2017
Medium6.1	Cross-Site Scripting Rimons Twitter Widget≤1.2.4Update to 1.3	CVE-2017-18533	—	Apr 16, 2017
Medium6.1	Cross-Site Scripting PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin<1.9.4Update to 1.9.4	CVE-2017-18528	—	Apr 14, 2017
Medium6.1	Reflected Cross-Site Scripting Htaccess by BestWebSoft – WordPress Website Access Control Plugin<1.7.6Update to 1.7.6	CVE-2017-18496	—	Apr 14, 2017
Medium6.1	Cross-Site Scripting Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more<1.2.5Update to 1.2.5	CVE-2017-7723	—	Apr 14, 2017
Medium6.1	Stored Cross-Site Scripting WP Statistics – Simple, privacy-friendly Google Analytics alternative≤12.0.4Update to 12.0.5	CVE-2017-2136	—	Apr 13, 2017
Medium6.1	Reflected Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress<4.0.6Update to 4.0.6	CVE-2017-18491	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Testimonials by BestWebSoft≤0.1.8Update to 0.1.9	CVE-2017-18558	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress≤1.5.6Update to 1.5.7	CVE-2017-18492	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting BestWebSoft’s Pinterest≤1.0.4Update to 1.0.5	CVE-2017-18517	—	Apr 12, 2017

High7.5
Directory Traversal
Task Scheduler
≤1.6.0Update to 1.6.1
CVE-2017-1000170May 8, 2017
Medium5.9
Unauthorized Password Reset via Interception
WordPress
<5.5Update to 5.5
CVE-2017-8295May 3, 2017
Medium6.1
Cross-Site Scripting
cformsII
≤14.13.2Update to 14.13.3
CVE-2017-18559Apr 28, 2017
Critical9.8
Object Injection
Gravitate QA Tracker
≤1.2.1No patch available
CVE-2017-18605Apr 27, 2017
Critical9.8
PHP Object Injection
SiteBuilder Dynamic Components
≤1.0No patch available
CVE-2017-18604Apr 27, 2017
Critical9.8
Arbitrary file upload
flickr-picture-backup
≤0.7No patch available
CVE-2017-1002016Apr 26, 2017
Medium6.1
Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.3Update to 4.0.3
CVE-2016-10706Apr 26, 2017
High8.8
Cross-Site Request Forgery
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
CVE-2017-18607Apr 26, 2017
Medium6.1
Stored Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
CVE-2017-18606Apr 26, 2017
High7.2
Authenticated SQL Injection
cformsII
<14.13Update to 14.13
CVE-2017-18570Apr 24, 2017
Medium6.1
Reflected Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<1.7.8Update to 1.7.8
CVE-2017-20008Apr 20, 2017
Critical9.8
Arbitrary File Upload
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤3.0.5Update to 3.1.0
CVE-2017-18592Apr 20, 2017
Medium6.1
Cross-Site Scripting
Spot.IM Comments
<4.0.4Update to 4.0.4
CVE-2017-18608Apr 19, 2017
Medium6.1
Reflected Cross-Site Scripting
Simple Job Board
<2.4.4Update to 2.4.4
CVE-2017-18498Apr 19, 2017
Medium6.1
Reflected Cross-Site Scripting
Timesheet by BestWebSoft
<0.1.5Update to 0.1.5
CVE-2017-18590Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Rating by BestWebSoft
<0.2Update to 0.2
CVE-2017-18530Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website
<1.1.1Update to 1.1.1
CVE-2017-18529Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Error Log Viewer by BestWebSoft
<1.0.6Update to 1.0.6
CVE-2017-18562Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Realty by BestWebSoft
<1.1.0Update to 1.1.0
CVE-2017-18532Apr 17, 2017
Medium6.1
Cross-Site Scripting
BestWebSoft's LinkedIn
<1.0.5Update to 1.0.5
CVE-2017-18516Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Social Buttons Pack by BestWebSoft
<1.1.1Update to 1.1.1
CVE-2017-18500Apr 17, 2017
Medium6.1
Cross-Site Scripting
Rimons Twitter Widget
≤1.2.4Update to 1.3
CVE-2017-18533Apr 16, 2017
Medium6.1
Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<1.9.4Update to 1.9.4
CVE-2017-18528Apr 14, 2017
Medium6.1
Reflected Cross-Site Scripting
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
<1.7.6Update to 1.7.6
CVE-2017-18496Apr 14, 2017
Medium6.1
Cross-Site Scripting
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.2.5Update to 1.2.5
CVE-2017-7723Apr 14, 2017
Medium6.1
Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.4Update to 12.0.5
CVE-2017-2136Apr 13, 2017
Medium6.1
Reflected Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.6Update to 4.0.6
CVE-2017-18491Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Testimonials by BestWebSoft
≤0.1.8Update to 0.1.9
CVE-2017-18558Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.5.6Update to 1.5.7
CVE-2017-18492Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
BestWebSoft’s Pinterest
≤1.0.4Update to 1.0.5
CVE-2017-18517Apr 12, 2017