CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1320)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1320)
Severity	Vulnerability	CVE	Installs	Published
Medium5.4	Missing Authorization LightStart – Maintenance Mode, Coming Soon and Landing Page Builder<2.0.7Update to 2.0.7	CVE-2018-20155	—	Jul 6, 2016
Medium4.3	Authenticated Information Disclosure LightStart – Maintenance Mode, Coming Soon and Landing Page Builder<2.0.7Update to 2.0.7	CVE-2018-20154	—	Jul 6, 2016
Medium6.1	Reflected Cross-Site Scripting Real3D Flipbook≤1.0.0No patch available	CVE-2016-10967	—	Jul 3, 2016
Critical9.1	Directory Traversal Real3D Flipbook≤1.0.0No patch available	CVE-2016-10965	—	Jul 3, 2016
High7.5	Arbitrary File Upload Advanced AJAX Page Loader<2.7.7Update to 2.7.7	CVE-2016-10929	—	Jul 3, 2016
High7.5	File Upload to User Controlled Location Real3D Flipbook≤1.0.0No patch available	CVE-2016-10966	—	Jul 3, 2016
Medium6.1	Cross-Site Scripting ColorWay≤3.4.1Update to 3.4.2	CVE-2016-10961	—	Jul 1, 2016
Medium6.1	Cross-Site Scripting via a ticket excerpt. SupportFlow<0.7Update to 0.7	CVE-2016-10970	—	Jun 28, 2016
Critical9.8	Authentication Bypass MemberSonic Lite Membership Site Plugin≤1.2Update to 1.302	CVE-2016-10971	—	Jun 28, 2016
Critical9.8	Authentication Bypass Welcart e-Commerce≤1.8.2Update to 1.8.3	CVE-2016-4828	—	Jun 24, 2016
High8.1	Object Injection Welcart e-Commerce<1.8.3Update to 1.8.3	CVE-2016-4825	—	Jun 24, 2016
Medium6.1	Reflected Cross-Site Scripting Welcart e-Commerce<1.8.3Update to 1.8.3	CVE-2016-4826	—	Jun 24, 2016
Medium6.1	Cross-Site Scripting Welcart e-Commerce≤1.8.2Update to 1.8.3	CVE-2016-4827	—	Jun 24, 2016
Critical9.8	Remote File Upload contus-video-comments≤1.0No patch available	CVE-2016-1000112	—	Jun 22, 2016
High8.8	Privilege Escalation Community by PeepSo – Download from PeepSo.com≤1.6.0Update to 1.6.1	CVE-2016-10968	—	Jun 21, 2016
Medium6.1	Cross-Site Scripting Jetpack – AI Agents & MCP, Security, Backup & Analytics<4.0.4Update to 4.0.4	CVE-2016-10705	—	Jun 20, 2016
High7.2	Stored Cross-Site Scripting via discussion ticket title SupportFlow≤0.6Update to 0.7	CVE-2016-10969	—	Jun 20, 2016
Medium6.4	Cross-Site Scripting via Attachment Name WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5834	—	Jun 18, 2016
High7.3	Bypass sanitize_file_name Protection WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5839	—	Jun 18, 2016
Medium4.3	Revision History Disclosure WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5835	—	Jun 18, 2016
Medium5.3	Denial of Service via oEmbed Protocol WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5836	—	Jun 18, 2016
Medium5.5	Cross-Site Scripting via Customizer WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5832	—	Jun 18, 2016
Medium6.4	Cross-Site Scripting via Attachment Name #2 WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5833	—	Jun 18, 2016
Medium5.3	Password Change via Stolen Cookie WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5838	—	Jun 18, 2016
Medium5.4	Authorization Bypass to Remove Category Attribute WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3	CVE-2016-5837	—	Jun 18, 2016
Critical9.8	SQL Injection Search Everything<8.1.6Update to 8.1.6	CVE-2016-10917	—	Jun 10, 2016
Critical9.6	Remote Code Execution EWWW Image Optimizer≤2.8.4Update to 2.8.5	CVE-2016-20010	—	Jun 8, 2016
Medium6.5	News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting Newspaper - News & WooCommerce WordPress Theme<6.7.2Update to 6.7.2	CVE-2017-18634	—	Jun 6, 2016
Critical9.8	News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update Newspaper - News & WooCommerce WordPress Theme≤6.7.1Update to 6.7.2	CVE-2016-10972	—	Jun 6, 2016
Critical9.8	Arbitrary File Upload WP Mobile Detector≤3.5Update to 3.6	CVE-2016-15043	—	Jun 3, 2016

Medium5.4
Missing Authorization
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
CVE-2018-20155Jul 6, 2016
Medium4.3
Authenticated Information Disclosure
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
CVE-2018-20154Jul 6, 2016
Medium6.1
Reflected Cross-Site Scripting
Real3D Flipbook
≤1.0.0No patch available
CVE-2016-10967Jul 3, 2016
Critical9.1
Directory Traversal
Real3D Flipbook
≤1.0.0No patch available
CVE-2016-10965Jul 3, 2016
High7.5
Arbitrary File Upload
Advanced AJAX Page Loader
<2.7.7Update to 2.7.7
CVE-2016-10929Jul 3, 2016
High7.5
File Upload to User Controlled Location
Real3D Flipbook
≤1.0.0No patch available
CVE-2016-10966Jul 3, 2016
Medium6.1
Cross-Site Scripting
ColorWay
≤3.4.1Update to 3.4.2
CVE-2016-10961Jul 1, 2016
Medium6.1
Cross-Site Scripting via a ticket excerpt.
SupportFlow
<0.7Update to 0.7
CVE-2016-10970Jun 28, 2016
Critical9.8
Authentication Bypass
MemberSonic Lite Membership Site Plugin
≤1.2Update to 1.302
CVE-2016-10971Jun 28, 2016
Critical9.8
Authentication Bypass
Welcart e-Commerce
≤1.8.2Update to 1.8.3
CVE-2016-4828Jun 24, 2016
High8.1
Object Injection
Welcart e-Commerce
<1.8.3Update to 1.8.3
CVE-2016-4825Jun 24, 2016
Medium6.1
Reflected Cross-Site Scripting
Welcart e-Commerce
<1.8.3Update to 1.8.3
CVE-2016-4826Jun 24, 2016
Medium6.1
Cross-Site Scripting
Welcart e-Commerce
≤1.8.2Update to 1.8.3
CVE-2016-4827Jun 24, 2016
Critical9.8
Remote File Upload
contus-video-comments
≤1.0No patch available
CVE-2016-1000112Jun 22, 2016
High8.8
Privilege Escalation
Community by PeepSo – Download from PeepSo.com
≤1.6.0Update to 1.6.1
CVE-2016-10968Jun 21, 2016
Medium6.1
Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.4Update to 4.0.4
CVE-2016-10705Jun 20, 2016
High7.2
Stored Cross-Site Scripting via discussion ticket title
SupportFlow
≤0.6Update to 0.7
CVE-2016-10969Jun 20, 2016
Medium6.4
Cross-Site Scripting via Attachment Name
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5834Jun 18, 2016
High7.3
Bypass sanitize_file_name Protection
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5839Jun 18, 2016
Medium4.3
Revision History Disclosure
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5835Jun 18, 2016
Medium5.3
Denial of Service via oEmbed Protocol
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5836Jun 18, 2016
Medium5.5
Cross-Site Scripting via Customizer
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5832Jun 18, 2016
Medium6.4
Cross-Site Scripting via Attachment Name #2
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5833Jun 18, 2016
Medium5.3
Password Change via Stolen Cookie
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5838Jun 18, 2016
Medium5.4
Authorization Bypass to Remove Category Attribute
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
CVE-2016-5837Jun 18, 2016
Critical9.8
SQL Injection
Search Everything
<8.1.6Update to 8.1.6
CVE-2016-10917Jun 10, 2016
Critical9.6
Remote Code Execution
EWWW Image Optimizer
≤2.8.4Update to 2.8.5
CVE-2016-20010Jun 8, 2016
Medium6.5
News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<6.7.2Update to 6.7.2
CVE-2017-18634Jun 6, 2016
Critical9.8
News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
Newspaper - News & WooCommerce WordPress Theme
≤6.7.1Update to 6.7.2
CVE-2016-10972Jun 6, 2016
Critical9.8
Arbitrary File Upload
WP Mobile Detector
≤3.5Update to 3.6
CVE-2016-15043Jun 3, 2016