CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1344)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1344)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Contact Form Clean and Simple<4.4.1Update to 4.4.1	CVE-2014-8955	—	Nov 7, 2014
High7.2	Missing Authorization Smart Forms – when you need more than just a contact form≤2.1.0Update to 2.1.1	CVE-2014-8803	—	Nov 6, 2014
Medium6.1	Reflected Cross-Site Scripting WP Photo Album Plus≤5.4.17Update to 5.4.18	CVE-2014-8814	—	Nov 6, 2014
Medium6.1	Reflected Cross-Site Scripting Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤2.8.6Update to 2.8.7	CVE-2014-8815	—	Nov 6, 2014
Critical9.8	3.11 - SQL Injection Store Locator for WordPress with Google Maps – LotsOfLocales<3.12Update to 3.12	CVE-2014-8621	—	Nov 5, 2014
High7.2	Stored Cross-Site Scripting Contact Bank – Contact Form Builder for WordPress≤2.0.69Update to 2.0.70	CVE-2014-8807	—	Nov 5, 2014
Medium5.4	Cross-Site Scripting BulletProof Security<.51.1Update to .51.1	CVE-2014-7958	—	Nov 5, 2014
Medium4.3	Server-Side Request Forgery BulletProof Security≤.51Update to .51.1	CVE-2014-8749	—	Nov 5, 2014
Medium6.1	JavaScript Injection WP Support Plus Responsive Ticket System≤4.0Update to 4.1	CVE-2014-10391	—	Nov 4, 2014
Medium6.1	2.6 - Cross-Site Scripting post highlights2.0 – 2.6Update to 2.6.1	CVE-2014-8087	—	Nov 3, 2014
High7.5	Missing Authorization Database Backup for WordPress≤2.2.4Update to 2.3.0	CVE-2014-10076	—	Nov 2, 2014
Medium5.3	Sensitive Data Exposure Album and Image Gallery with Lightbox – Flagallery Photo Portfolio<4.25Update to 4.25	CVE-2014-8491	—	Oct 30, 2014
Medium6.1	Reflected Cross-Site Scripting User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor≤2.0.2Update to 2.0.3	CVE-2014-8492	—	Oct 30, 2014
Critical9.8	Arbitrary File Upload Creative Contact Form<1.0.0Update to 1.0.0	CVE-2014-8739	—	Oct 23, 2014
Critical9.8	SQL Injection CP Multi View Events Calendar<1.0.2Update to 1.0.2	CVE-2014-8586	—	Oct 23, 2014
Medium6.1	Cross-Site Scripting NEX-Forms Lite – WordPress Contact Form builder<3.4Update to 3.4	CVE-2014-7151	—	Oct 21, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-10382	—	Oct 21, 2014
Medium6.1	Reflected Cross-Site Scripting Gallery Bank – WordPress Photo Gallery Plugin<3.0.70Update to 3.0.70	CVE-2014-8758	—	Oct 18, 2014
High7.2	2.4 - Stored Cross-Site Scripting Contact Form Integrated With Google Maps1.0 – 2.4Update to 2.5	CVE-2014-7238	—	Oct 18, 2014
High7.5	Improper Access Control to Information Disclosure Backup, Restore and Migrate your sites with XCloner≤3.1.1Update to 3.1.2	CVE-2014-8605	—	Oct 17, 2014
High7.5	Sensitive Information Disclosure Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8604	—	Oct 17, 2014
High7.2	Sensitive Information Disclosure Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8607	—	Oct 17, 2014
Medium6.1	Stored Cross-Site Scripting Easy Contact Form Solution<1.7Update to 1.7	CVE-2014-7240	—	Oct 17, 2014
High7.2	Remote Code Execution Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8603	—	Oct 17, 2014
Medium4.9	Directory Traversal Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8606	—	Oct 17, 2014
Medium6.1	Cross-Site Scripting cformsII≤13.1Update to 13.2	CVE-2014-10377	—	Oct 16, 2014
High8.8	Cross-Site Request Forgery O2tweet≤0.0.4No patch available	CVE-2014-9338	—	Oct 15, 2014
Medium6.1	Cross-Site Scripting cforms≤10.1Update to 10.2	CVE-2014-10392	—	Oct 15, 2014
Medium6.1	Reflected Cross-Site Scripting WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator<6.0.27Update to 6.0.27	CVE-2014-7182	—	Oct 15, 2014
Medium6.1	Cross-Site Scripting cforms<10.5Update to 10.5	CVE-2014-10393	—	Oct 15, 2014

Medium6.1
Cross-Site Scripting
Contact Form Clean and Simple
<4.4.1Update to 4.4.1
CVE-2014-8955Nov 7, 2014
High7.2
Missing Authorization
Smart Forms – when you need more than just a contact form
≤2.1.0Update to 2.1.1
CVE-2014-8803Nov 6, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Photo Album Plus
≤5.4.17Update to 5.4.18
CVE-2014-8814Nov 6, 2014
Medium6.1
Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤2.8.6Update to 2.8.7
CVE-2014-8815Nov 6, 2014
Critical9.8
3.11 - SQL Injection
Store Locator for WordPress with Google Maps – LotsOfLocales
<3.12Update to 3.12
CVE-2014-8621Nov 5, 2014
High7.2
Stored Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
≤2.0.69Update to 2.0.70
CVE-2014-8807Nov 5, 2014
Medium5.4
Cross-Site Scripting
BulletProof Security
<.51.1Update to .51.1
CVE-2014-7958Nov 5, 2014
Medium4.3
Server-Side Request Forgery
BulletProof Security
≤.51Update to .51.1
CVE-2014-8749Nov 5, 2014
Medium6.1
JavaScript Injection
WP Support Plus Responsive Ticket System
≤4.0Update to 4.1
CVE-2014-10391Nov 4, 2014
Medium6.1
2.6 - Cross-Site Scripting
post highlights
2.0 – 2.6Update to 2.6.1
CVE-2014-8087Nov 3, 2014
High7.5
Missing Authorization
Database Backup for WordPress
≤2.2.4Update to 2.3.0
CVE-2014-10076Nov 2, 2014
Medium5.3
Sensitive Data Exposure
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<4.25Update to 4.25
CVE-2014-8491Oct 30, 2014
Medium6.1
Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.0.2Update to 2.0.3
CVE-2014-8492Oct 30, 2014
Critical9.8
Arbitrary File Upload
Creative Contact Form
<1.0.0Update to 1.0.0
CVE-2014-8739Oct 23, 2014
Critical9.8
SQL Injection
CP Multi View Events Calendar
<1.0.2Update to 1.0.2
CVE-2014-8586Oct 23, 2014
Medium6.1
Cross-Site Scripting
NEX-Forms Lite – WordPress Contact Form builder
<3.4Update to 3.4
CVE-2014-7151Oct 21, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-10382Oct 21, 2014
Medium6.1
Reflected Cross-Site Scripting
Gallery Bank – WordPress Photo Gallery Plugin
<3.0.70Update to 3.0.70
CVE-2014-8758Oct 18, 2014
High7.2
2.4 - Stored Cross-Site Scripting
Contact Form Integrated With Google Maps
1.0 – 2.4Update to 2.5
CVE-2014-7238Oct 18, 2014
High7.5
Improper Access Control to Information Disclosure
Backup, Restore and Migrate your sites with XCloner
≤3.1.1Update to 3.1.2
CVE-2014-8605Oct 17, 2014
High7.5
Sensitive Information Disclosure
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8604Oct 17, 2014
High7.2
Sensitive Information Disclosure
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8607Oct 17, 2014
Medium6.1
Stored Cross-Site Scripting
Easy Contact Form Solution
<1.7Update to 1.7
CVE-2014-7240Oct 17, 2014
High7.2
Remote Code Execution
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8603Oct 17, 2014
Medium4.9
Directory Traversal
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8606Oct 17, 2014
Medium6.1
Cross-Site Scripting
cformsII
≤13.1Update to 13.2
CVE-2014-10377Oct 16, 2014
High8.8
Cross-Site Request Forgery
O2tweet
≤0.0.4No patch available
CVE-2014-9338Oct 15, 2014
Medium6.1
Cross-Site Scripting
cforms
≤10.1Update to 10.2
CVE-2014-10392Oct 15, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<6.0.27Update to 6.0.27
CVE-2014-7182Oct 15, 2014
Medium6.1
Cross-Site Scripting
cforms
<10.5Update to 10.5
CVE-2014-10393Oct 15, 2014