CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1346)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1346)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	SQL Injection gallery-objects≤0.4No patch available	CVE-2014-5201	—	Sep 19, 2014
Medium6.3	Multiple Cross-Site Request Forgery Disqus Comment System<2.79Update to 2.79	CVE-2014-5346	—	Sep 17, 2014
Medium5.3	Improper Input Validation WP-Ban<1.64Update to 1.64	CVE-2014-6230	—	Sep 17, 2014
High7.1	Cross-Site Scripting Login Widget With Shortcode<3.2.1Update to 3.2.1	CVE-2014-6312	—	Sep 17, 2014
Medium6.1	1.6.1 - Cross-Site Scripting Cakifo1.0 – 1.6.1Update to 1.6.2	CVE-2014-3903	—	Sep 17, 2014
High7.3	Cross-Site Scripting via range Parameter WooCommerce<2.2.3Update to 2.2.3	CVE-2014-6313	—	Sep 15, 2014
Medium5.3	Full Path Disclosure WP Support Plus Responsive Ticket System<4.2Update to 4.2	CVE-2014-10388	—	Sep 9, 2014
Critical9.8	SQL Injection WP Support Plus Responsive Ticket System<4.2Update to 4.2	CVE-2014-10387	—	Sep 9, 2014
High7.5	Arbitrary File Download Antioch≤1.3No patch available	CVE-2014-10397	—	Sep 8, 2014
Critical9.8	Arbitrary File Download Epic Church by Organized Themes≤3.6No patch available	CVE-2014-10396	—	Sep 8, 2014
High8.8	Responsive Photo Gallery <= 1.0.7 - SQL Injection Image Gallery - Responsive Photo Gallery≤1.0.7Update to 1.0.8	CVE-2014-7153	—	Sep 2, 2014
High8.8	Arbitrary File Upload Slideshow Gallery LITE<1.4.7Update to 1.4.7	CVE-2014-5460	—	Aug 29, 2014
Medium5.3	Security Bypass Jetpack – AI Agents & MCP, Security, Backup & Analytics≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3	CVE-2014-0173	—	Aug 26, 2014
Medium6.1	Cross-Site Scripting Memphis Documents Library<3.0Update to 3.0	CVE-2014-10385	—	Aug 21, 2014
High7.2	Arbitrary File Overwrite Access Governance for WordPress (aka AAM)<2.8.3Update to 2.8.3	CVE-2014-6059	—	Aug 20, 2014
Medium6.1	Reflected Cross-Site Scripting Iptanus File Upload≤2.4.3Update to 2.4.4	CVE-2014-125110	—	Aug 20, 2014
High7.5	Directory Traversal WP Source Control<3.1.1Update to 3.1.1	CVE-2014-5368	—	Aug 19, 2014
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Improved user search in backend≤1.2.5Update to 1.2.6	CVE-2014-5196	—	Aug 13, 2014
Medium5.4	Cross-Site Request Forgery Disqus Comment System<2.76Update to 2.76	CVE-2014-5347	—	Aug 12, 2014
Medium6.1	Cross-Site Scripting MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps<2.3.8Update to 2.3.8	CVE-2014-5344	—	Aug 11, 2014
High8.3	SQL Injection GB Gallery Slideshow<1.6Update to 1.6	CVE-2014-8375	—	Aug 11, 2014
Medium6.3	Cross-Site Request Forgery Iptanus File Upload<2.4.2Update to 2.4.2	CVE-2014-5199	—	Aug 8, 2014
Medium6.5	Unauthenticated Stored Cross-Site Scripting Job Board by BestWebSoft≤1.0.0Update to 1.0.1	CVE-2014-125100	—	Aug 8, 2014
High7.1	Reflected Cross-Site Scripting SI Captcha Anti-spam<2.7.6Update to 2.7.6	CVE-2014-5190	—	Aug 7, 2014
Medium6.1	Open Redirect Feed Statistics<4.0Update to 4.0	CVE-2018-17074	—	Aug 7, 2014
High7.2	Unauthenticated Stored Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.81Update to 3.82	CVE-2014-125095	—	Aug 7, 2014
Medium4.4	Authenticated (Admin+) Stored Cross-Site Scripting BestWebSoft's Twitter≤1.3.2Update to 1.3.7	CVE-2014-125103	—	Aug 7, 2014
High7.2	Deserialization via Widgets WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2	CVE-2014-5203	—	Aug 6, 2014
Medium6.1	Cross-Site Scripting WordPress Spreadsheet≤0.62No patch available	CVE-2014-8364	—	Aug 6, 2014
Critical9.8	SQL Injection WordPress Spreadsheet≤0.62No patch available	CVE-2014-8363	—	Aug 6, 2014

Critical9.8
SQL Injection
gallery-objects
≤0.4No patch available
CVE-2014-5201Sep 19, 2014
Medium6.3
Multiple Cross-Site Request Forgery
Disqus Comment System
<2.79Update to 2.79
CVE-2014-5346Sep 17, 2014
Medium5.3
Improper Input Validation
WP-Ban
<1.64Update to 1.64
CVE-2014-6230Sep 17, 2014
High7.1
Cross-Site Scripting
Login Widget With Shortcode
<3.2.1Update to 3.2.1
CVE-2014-6312Sep 17, 2014
Medium6.1
1.6.1 - Cross-Site Scripting
Cakifo
1.0 – 1.6.1Update to 1.6.2
CVE-2014-3903Sep 17, 2014
High7.3
Cross-Site Scripting via range Parameter
WooCommerce
<2.2.3Update to 2.2.3
CVE-2014-6313Sep 15, 2014
Medium5.3
Full Path Disclosure
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
CVE-2014-10388Sep 9, 2014
Critical9.8
SQL Injection
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
CVE-2014-10387Sep 9, 2014
High7.5
Arbitrary File Download
Antioch
≤1.3No patch available
CVE-2014-10397Sep 8, 2014
Critical9.8
Arbitrary File Download
Epic Church by Organized Themes
≤3.6No patch available
CVE-2014-10396Sep 8, 2014
High8.8
Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.0.7Update to 1.0.8
CVE-2014-7153Sep 2, 2014
High8.8
Arbitrary File Upload
Slideshow Gallery LITE
<1.4.7Update to 1.4.7
CVE-2014-5460Aug 29, 2014
Medium5.3
Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
CVE-2014-0173Aug 26, 2014
Medium6.1
Cross-Site Scripting
Memphis Documents Library
<3.0Update to 3.0
CVE-2014-10385Aug 21, 2014
High7.2
Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)
<2.8.3Update to 2.8.3
CVE-2014-6059Aug 20, 2014
Medium6.1
Reflected Cross-Site Scripting
Iptanus File Upload
≤2.4.3Update to 2.4.4
CVE-2014-125110Aug 20, 2014
High7.5
Directory Traversal
WP Source Control
<3.1.1Update to 3.1.1
CVE-2014-5368Aug 19, 2014
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend
≤1.2.5Update to 1.2.6
CVE-2014-5196Aug 13, 2014
Medium5.4
Cross-Site Request Forgery
Disqus Comment System
<2.76Update to 2.76
CVE-2014-5347Aug 12, 2014
Medium6.1
Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps
<2.3.8Update to 2.3.8
CVE-2014-5344Aug 11, 2014
High8.3
SQL Injection
GB Gallery Slideshow
<1.6Update to 1.6
CVE-2014-8375Aug 11, 2014
Medium6.3
Cross-Site Request Forgery
Iptanus File Upload
<2.4.2Update to 2.4.2
CVE-2014-5199Aug 8, 2014
Medium6.5
Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft
≤1.0.0Update to 1.0.1
CVE-2014-125100Aug 8, 2014
High7.1
Reflected Cross-Site Scripting
SI Captcha Anti-spam
<2.7.6Update to 2.7.6
CVE-2014-5190Aug 7, 2014
Medium6.1
Open Redirect
Feed Statistics
<4.0Update to 4.0
CVE-2018-17074Aug 7, 2014
High7.2
Unauthenticated Stored Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.81Update to 3.82
CVE-2014-125095Aug 7, 2014
Medium4.4
Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter
≤1.3.2Update to 1.3.7
CVE-2014-125103Aug 7, 2014
High7.2
Deserialization via Widgets
WordPress
≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5203Aug 6, 2014
Medium6.1
Cross-Site Scripting
WordPress Spreadsheet
≤0.62No patch available
CVE-2014-8364Aug 6, 2014
Critical9.8
SQL Injection
WordPress Spreadsheet
≤0.62No patch available
CVE-2014-8363Aug 6, 2014