VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 133)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 133)
SeverityVulnerabilityCVEInstallsPublished
High7.2Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
WP EasyCart: Shopping Cart and eCommerce Store≤5.9.3Update to 5.9.4
CVE-2026-17553—
Medium6.1Reflected Cross-Site Scripting via 'wpf_fid' Parameter
Product Filter for WooCommerce by WBW≤3.4.2Update to 3.4.3
CVE-2026-7804—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
Podlove Podcast Publisher≤4.5.5Update to 4.5.6
CVE-2026-75966—
Medium4.9Authenticated (Custom+) SQL Injection via 'status' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance≤1.31.0Update to 1.31.1
CVE-2026-19800—
Medium6.6Authenticated (Administrator+) PHP Object Injection via Form Import
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.14.6Update to 3.14.7
CVE-2026-11363—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
My Calendar – Accessible Event Manager≤3.8.3Update to 3.8.4
CVE-2026-77186—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
My Calendar – Accessible Event Manager≤3.8.3Update to 3.8.4
CVE-2026-77187—
High8.8Authenticated (Author+) Remote Code Execution to Privilege Escalation
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment≤3.1.10Update to 3.1.11
CVE-2026-76801—
High7.5Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-15667—
High7.5Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-15406—
High7.2Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress≤1.7.5Update to 1.7.6
CVE-2026-13359—
Medium5.3Captcha Bypass
Simple CAPTCHA with Cloudflare Turnstile≤1.42.1Update to 1.42.3
CVE-2026-66674—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce≤4.1.22Update to 4.1.23
CVE-2026-12956—
High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin≤2.3.3Update to 2.3.4
CVE-2026-84819—
High7.2Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
Repeater Fields for Gravity Forms≤3.0.4Update to 3.1.0
CVE-2026-84293—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
WP-Stateless – Google Cloud Storage≤4.4.1Update to 4.4.2
CVE-2026-81801—
Medium5.3Missing Authorization
Return Refund and Exchange For WooCommerce≤4.6.4Update to 4.6.5
CVE-2026-81799—
Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine≤12.0.3Update to 12.0.4
CVE-2026-81796—
High7.2Unauthenticated Stored Cross-Site Scripting
Page Visits Counter – Lite≤1.2.3Update to 2.0.0
CVE-2026-81795—
Medium5.3 Unauthenticated Unauthorized Lead and Search Manipulation
IMPress for IDX Broker≤3.3.0Update to 3.3.1
CVE-2026-81787—
Medium5.3Missing Authorization
Thanko Thank You Page Customizer for WooCommerce≤1.2.2Update to 1.2.3
CVE-2026-81786—
High8.1Unauthenticated PHP Object Injection
Wise Chat≤3.4.2Update to 3.4.3
CVE-2026-81784—
Medium4.3Missing Authorization
MailMunch – Grow your Email List≤3.3.0Update to 3.3.1
CVE-2026-81783—
Medium5.36.3.0 - Unauthenticated Second Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)≤19.2Update to 19.3 or 6.3.1
CVE-2026-77771—
Medium6.1Unauthenticated Arbitrary Shortcode Execution
Simple CAPTCHA with Cloudflare Turnstile≤1.42.1Update to 1.42.3
CVE-2026-66632—
Medium5.3 Unauthenticated Inflated Gift Card Credit Acquisition
Ultimate Gift Cards for WooCommerce<3.2.10Update to 3.2.10
CVE-2026-19436—
High7.26.2.5 - Unauthenticated Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer6.2.1 – 6.2.5Update to 6.3.0
CVE-2026-84219—
Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas≤10.31.5No patch available
CVE-2026-81793—
Medium4.3Missing Authorization
IMPress for IDX Broker≤3.3.0Update to 3.3.1
CVE-2026-81788—
Medium5.3Unauthorized WordPress Account Creation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments<4.7.0Update to 4.7.0
CVE-2026-75793—

Search VulnCrest Radar

Jump to

Are you sure?