CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1341)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Authenticated Stored Cross-Site Scripting
Simple Security
≤1.1.5Update to 1.1.6
- Medium6.1Stored Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.5.6Update to 3.5.6
- Critical9.8Unauthenticated Blind SQL Injection via order_by Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.8Update to 1.2.8
- Medium6.1Cross-Site Scripting
Pods – Custom Content Types and Fields
≤2.4.3Update to 2.5
- Critical9.6Multiple Cross-Site Request Forgery
Pods – Custom Content Types and Fields
≤2.4.3Update to 2.5
- Medium6.1Reflected Cross-Site Scripting
Greg's High Performance SEO
<1.6.2Update to 1.6.2
- High8.8Arbitrary File Upload
WP EasyCart: Shopping Cart and eCommerce Store
<3.0.16Update to 3.0.16
- Medium6.1Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.9.3Update to 3.9.3
- Medium6.1Cross-Site Scripting
Relevanssi – A Better Search
<3.3.8Update to 3.3.8
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
simpleflickr
≤3.0.3No patch available
- High8.8Cross-Site Request Forgery
Banner Effect Header
<1.2.8Update to 1.2.8
- Medium6.5WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure
Cart66 Lite :: WordPress Ecommerce
<1.5.4Update to 1.5.4
- Critical9.8Arbitrary File Upload
cformsII
<14.8Update to 14.8
- High7.5Arbitrary File Read
Sell Downloads
≤1.0.1Update to 1.0.2
- Medium6.1Cross-Site Scripting
Frontend Uploader
<0.9.4Update to 0.9.4
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
wordpress-backup-to-dropbox
<4.1Update to 4.1
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Post to Twitter
≤0.7No patch available
- High8.8Cross-Site Request Forgery
gSlideShow
≤0.1No patch available
- High8.8Cross-Site Request Forgery leading to Cross-Site Scripting
wp-limit-posts-automatically
≤0.7No patch available
- Medium6.1Cross-Site Request Forgery
PictoBrowser
≤0.3.1No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
wp-unique-article-header-image
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
PWGRandom
≤1.11No patch available
- High7.5Directory Traversal
Slider Revolution
≤4.1.4Update to 4.2
- High7.2Cross-Site Scripting
Slider Revolution
≤4.2.2Update to 4.2.3
- High7.5Directory Traversal
DB Backup
<5.0Update to 5.0
- Medium5.4Cross-Site Scripting
W3 Total Cache
≤0.9.4Update to 0.9.4.1
- Medium6.1Cross-Site Scripting
iTwitter
≤0.04No patch available
- High8.8Cross-Site Request Forgery and Stored Cross-Site Scripting
Sliding Social Icons
≤1.61No patch available
- Medium6.1Cross-Site Scripting
wpCommentTwit
≤0.5No patch available