CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1327)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1327)
Severity	Vulnerability	CVE	Installs	Published
Medium6.6	PHP Object Injection SecureMoz Security Audit≤1.0.5No patch available	CVE-2015-6828	—	Sep 5, 2015
Critical9.8	Remote File Inclusion Memphis Documents Library<3.0Update to 3.0	CVE-2014-10383	—	Sep 4, 2015
Medium6.3	Cross-Site Request Forgery Contact Form Generator : Creative form builder for WordPress≤2.1.86Update to 2.5.0	CVE-2015-6965	—	Sep 4, 2015
Critical9.8	Local File Inclusion Memphis Documents Library≤2.6.16Update to 3.0	CVE-2014-10384	—	Sep 4, 2015
Critical9.8	Remote File Inclusion via TimThumb BJ Lazy Load0.7.5 – 0.7.5Update to 1.0	CVE-2015-9415	—	Sep 2, 2015
Medium6.1	Cross-Site Scripting in Accept-Language Header WPML Multilingual CMS2.9.3 – 3.2.6Update to 3.2.7	CVE-2015-9416	—	Sep 2, 2015
Medium4.3	Cross-Site Request Forgery WatuPRO<4.9.0.8Update to 4.9.0.8	CVE-2015-9418	—	Sep 1, 2015
Medium6.1	Cross-Site Request Forgery to Stored Cross-Site Scripting Testimonial Slider≤1.2.5Update to 1.3.0	CVE-2015-9417	—	Sep 1, 2015
Medium6.1	Reflected Cross-Site Scripting CKEditor for WordPress≤4.5.3Update to 4.5.3.1	CVE-2015-9349	—	Aug 31, 2015
Medium6.4	Cross-Site Scripting Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤2.1.9Update to 2.1.10	CVE-2015-9537	—	Aug 31, 2015
High8.8	Authenticated (Subscriber+) Arbitrary File Upload Responsive Thumbnail Slider<1.0.1Update to 1.0.1	CVE-2015-10144	—	Aug 29, 2015
Medium6.1	Cross-Site Scripting sourceAFRICA≤0.1.3No patch available	CVE-2015-6920	—	Aug 29, 2015
Medium6.1	Stored Cross-Site Scripting Captain Slider≤1.0.6No patch available	CVE-2015-9419	—	Aug 28, 2015
Medium6.5	Local File Inclusion Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤2.1.10Update to 2.1.15	CVE-2015-9538	—	Aug 28, 2015
High7.5	Insecure Direct Object Reference Job Manager≤0.7.25No patch available	CVE-2015-6668	—	Aug 28, 2015
Medium6.1	Reflected Cross-Site Scripting Navis DocumentCloud<0.1.1Update to 0.1.1	CVE-2015-2807	—	Aug 26, 2015
Medium5.5	Cross-Site Scripting Embeds for YouTube<3.3.3Update to 3.3.3	CVE-2015-6535	—	Aug 26, 2015
Medium6.1	Reflected Cross-Site Scripting SoundCloud Is Gold<2.3.2Update to 2.3.2	CVE-2015-9420	—	Aug 26, 2015
High8.8	Multiple Cross-Site Request Forgery Private Only≤3.5.1No patch available	CVE-2015-5483	—	Aug 26, 2015
High8.8	SQL Injection WordPress Meta Robots≤2.1No patch available	CVE-2015-9400	—	Aug 25, 2015
Medium6.1	Reflected Cross-Site Scripting Simple Fields<1.4.11Update to 1.4.11	CVE-2015-9302	—	Aug 25, 2015
High8.8	Authenticated Blind SQL Injection GoCodes≤1.3.5No patch available	CVE-2015-9398	—	Aug 25, 2015
Medium6.1	Cross-Site Request Forgery to Stored Cross-Site Scripting Cincopa video and media plug-in<1.137Update to 1.137	CVE-2015-10109	—	Aug 25, 2015
Medium6.1	Stored Cross-Site Scripting SEO Redirection Plugin – 301 Redirect Manager<4.3Update to 4.3	CVE-2016-10896	—	Aug 25, 2015
Medium5.4	Cross-Site Scripting GoCodes≤1.3.5No patch available	CVE-2015-9397	—	Aug 25, 2015
Medium6.3	Cross-Site Request Forgery Multicons<3.0Update to 3.0	CVE-2015-9424	—	Aug 25, 2015
Medium6.1	Reflected Cross-Site Scripting Olevmedia Shortcodes<1.1.9Update to 1.1.9	CVE-2015-9421	—	Aug 25, 2015
Medium6.1	Reflected Cross-Site Scripting OnePress Social Locker<4.2.5Update to 4.2.5	CVE-2015-9425	—	Aug 25, 2015
Medium5.4	Authenticated Stored Cross-Site Scripting plugnedit<6.2.0Update to 6.2.0	CVE-2015-9423	—	Aug 25, 2015
Medium6.5	Cross-Site Request Forgery leading to Stored Cross-Site Scripting plugnedit<6.2.0Update to 6.2.0	CVE-2015-9422	—	Aug 25, 2015

Medium6.6
PHP Object Injection
SecureMoz Security Audit
≤1.0.5No patch available
CVE-2015-6828Sep 5, 2015
Critical9.8
Remote File Inclusion
Memphis Documents Library
<3.0Update to 3.0
CVE-2014-10383Sep 4, 2015
Medium6.3
Cross-Site Request Forgery
Contact Form Generator : Creative form builder for WordPress
≤2.1.86Update to 2.5.0
CVE-2015-6965Sep 4, 2015
Critical9.8
Local File Inclusion
Memphis Documents Library
≤2.6.16Update to 3.0
CVE-2014-10384Sep 4, 2015
Critical9.8
Remote File Inclusion via TimThumb
BJ Lazy Load
0.7.5 – 0.7.5Update to 1.0
CVE-2015-9415Sep 2, 2015
Medium6.1
Cross-Site Scripting in Accept-Language Header
WPML Multilingual CMS
2.9.3 – 3.2.6Update to 3.2.7
CVE-2015-9416Sep 2, 2015
Medium4.3
Cross-Site Request Forgery
WatuPRO
<4.9.0.8Update to 4.9.0.8
CVE-2015-9418Sep 1, 2015
Medium6.1
Cross-Site Request Forgery to Stored Cross-Site Scripting
Testimonial Slider
≤1.2.5Update to 1.3.0
CVE-2015-9417Sep 1, 2015
Medium6.1
Reflected Cross-Site Scripting
CKEditor for WordPress
≤4.5.3Update to 4.5.3.1
CVE-2015-9349Aug 31, 2015
Medium6.4
Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.9Update to 2.1.10
CVE-2015-9537Aug 31, 2015
High8.8
Authenticated (Subscriber+) Arbitrary File Upload
Responsive Thumbnail Slider
<1.0.1Update to 1.0.1
CVE-2015-10144Aug 29, 2015
Medium6.1
Cross-Site Scripting
sourceAFRICA
≤0.1.3No patch available
CVE-2015-6920Aug 29, 2015
Medium6.1
Stored Cross-Site Scripting
Captain Slider
≤1.0.6No patch available
CVE-2015-9419Aug 28, 2015
Medium6.5
Local File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
CVE-2015-9538Aug 28, 2015
High7.5
Insecure Direct Object Reference
Job Manager
≤0.7.25No patch available
CVE-2015-6668Aug 28, 2015
Medium6.1
Reflected Cross-Site Scripting
Navis DocumentCloud
<0.1.1Update to 0.1.1
CVE-2015-2807Aug 26, 2015
Medium5.5
Cross-Site Scripting
Embeds for YouTube
<3.3.3Update to 3.3.3
CVE-2015-6535Aug 26, 2015
Medium6.1
Reflected Cross-Site Scripting
SoundCloud Is Gold
<2.3.2Update to 2.3.2
CVE-2015-9420Aug 26, 2015
High8.8
Multiple Cross-Site Request Forgery
Private Only
≤3.5.1No patch available
CVE-2015-5483Aug 26, 2015
High8.8
SQL Injection
WordPress Meta Robots
≤2.1No patch available
CVE-2015-9400Aug 25, 2015
Medium6.1
Reflected Cross-Site Scripting
Simple Fields
<1.4.11Update to 1.4.11
CVE-2015-9302Aug 25, 2015
High8.8
Authenticated Blind SQL Injection
GoCodes
≤1.3.5No patch available
CVE-2015-9398Aug 25, 2015
Medium6.1
Cross-Site Request Forgery to Stored Cross-Site Scripting
Cincopa video and media plug-in
<1.137Update to 1.137
CVE-2015-10109Aug 25, 2015
Medium6.1
Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
<4.3Update to 4.3
CVE-2016-10896Aug 25, 2015
Medium5.4
Cross-Site Scripting
GoCodes
≤1.3.5No patch available
CVE-2015-9397Aug 25, 2015
Medium6.3
Cross-Site Request Forgery
Multicons
<3.0Update to 3.0
CVE-2015-9424Aug 25, 2015
Medium6.1
Reflected Cross-Site Scripting
Olevmedia Shortcodes
<1.1.9Update to 1.1.9
CVE-2015-9421Aug 25, 2015
Medium6.1
Reflected Cross-Site Scripting
OnePress Social Locker
<4.2.5Update to 4.2.5
CVE-2015-9425Aug 25, 2015
Medium5.4
Authenticated Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
CVE-2015-9423Aug 25, 2015
Medium6.5
Cross-Site Request Forgery leading to Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
CVE-2015-9422Aug 25, 2015