CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1313)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Custom Admin Page by BestWebSoft – Configurable WordPress Dashboard Pages Plugin
≤0.1.1Update to 0.1.2
- Medium6.1ReflectedCross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<3.96Update to 3.96
- Medium6.1Reflected Cross-Site Scripting
Contact Form Multi by BestWebSoft – Multiple Forms Plugin for Single WordPress Website
<1.2.1Update to 1.2.1
- Medium6.1Multiple Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.5.6Update to 1.5.7
- Medium6.1Reflected Cross-Site Scripting
Custom Search by BestWebSoft – WordPress Custom Search Plugin
≤1.35Update to 1.36
- Medium6.1Reflected Cross-Site Scripting
Visitors Online by BestWebSoft
<1.0.0Update to 1.0.0
- Medium6.1Multiple Cross-Site Scripting
Subscriber by BestWebSoft
≤1.3.4Update to 1.3.5
- Medium6.1Multiple Cross-Site Scripting
Social Login by BestWebSoft
≤0.1Update to 0.2
- Medium6.1Multiple Cross-Site Scripting
SMTP by BestWebSoft
≤1.0.9Update to 1.1.0
- Medium6.1Cross-Site Scripting
Help Center by BestWebSoft
≤1.0.4Update to 1.0.5
- Medium6.1Multiple Cross-Site Scripting
Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress
≤1.7.0Update to 1.7.1
- Medium6.1Multiple Cross-Site Scripting
Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Scripting
User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress
≤1.5.5Update to 1.5.6
- Medium6.1Reflected Cross-Site Scripting
Maps by BestWebSoft
≤1.3.5Update to 1.3.6
- Medium6.1Cross-Site Scripting
BestWebSoft's Twitter
<2.55Update to 2.55
- Medium6.1Multiple Cross-Site Scripting
AdPush
≤1.43Update to 1.44
- Medium6.1Reflected Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.5Update to 1.6.6
- Critical9.8SQL Injection
SpiderCalendar
≤1.5.51Update to 1.5.52
- High8.8Cross-Site Request Forgery
WHIZZ
≤1.1Update to 1.1.1
- Medium6.5Cross-Site Request Forgery
CopySafe Web Protection – Copy Protect Images
<2.6Update to 2.6
- High8.8Cross-Site Request Forgery
Twitter Cards Meta – Best Twitter Card Plugin for WordPress
≤2.4.5Update to 2.5.0
- Medium6.1Cross-Site Scripting
Twitter Cards Meta – Best Twitter Card Plugin for WordPress
<2.5.0Update to 2.5.0
- Medium6.1All In One Schema Rich Snippets <= 1.4.4 - Cross-Site Scripting
Schema – All In One Schema Rich Snippets
<1.5.0Update to 1.5.0
- Medium5.4Stored Cross-Site Scripting
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8SQL Injection via gid
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8Blind SQL Injection via imgid
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8SQL Injection via gallery_name
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8SQL Injection via selectMulGallery
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- High8.2Open Proxy
filedownload
≤1.4Update to 2.0
- Medium6.1Reflected Cross-Site Scripting
YOP Poll
<5.8.1Update to 5.8.1