CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1321)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2016-15040 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-4812 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-9337 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10973 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10974 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10975 | — | |
| High8.1 | 2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1 | CVE-2016-1209 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10885 | — | |
| Medium6.5 | Directory Traversal | CVE-2016-10977 | — | |
| Critical9.8 | SQL Injection | CVE-2016-11018 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10893 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2015-10128 | — | |
| High7.2 | Cross-Site Scripting | CVE-2016-10976 | — | |
| Medium6.4 | Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4567 | — | |
| Medium6.1 | Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4566 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10994 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2016-15041 | — | |
| High7.5 | Missing Authorization Checks | CVE-2016-10983 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10920 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2016-10897 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-10995 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10986 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10984 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10985 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10987 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10870 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2016-10988 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-10981 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10982 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10989 | — |
- Critical9.8SQL Injection
Kento Post View Counter
≤2.8No patch available
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
- High8.8Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- Medium6.1Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- High8.12.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
- High8.8Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
- Medium6.5Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
- Critical9.8SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
- Medium6.1Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
- High7.2Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
- Medium6.4Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
- High7.2Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
- High7.5Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
- Medium6.1Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
- Medium6.1Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
- Critical9.8Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0
- Medium6.1Reflected Cross-Site Scripting
Tweet Wheel
<1.0.3.3Update to 1.0.3.3
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤3.3.2Update to 3.3.3
- Medium6.1Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.06Update to 5.0.06
- Medium5.4Stored Cross-Site Scripting
leenk.me
<2.6.0Update to 2.6.0
- Medium6.1Stored Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- High8.8Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available
- High8.8Cross-Site Request Forgery
leenk.me
≤2.5.0Update to 2.6.0