VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1347)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1347)
SeverityVulnerabilityCVEInstallsPublished
High7.2Deserialization via Widgets
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5203—
Medium6.1Cross-Site Scripting
WordPress Spreadsheet≤0.62No patch available
CVE-2014-8364—
Medium6.5Denial of Service via XML #2
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5266—
Low2.7Denial of Service via XML
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5265—
High8.8Cross-Site Request Forgery Protection Bypass
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5204—
Medium5.3XML External Entity (XXE) Weakness
WordPress<3.9.2Update to 3.9.2
CVE-2014-2053—
High8.8Cross-Site Request Forgery to Authentication Takeover
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-9033—
High7.2Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links<1.6.3Update to 1.6.3
CVE-2013-1636—
Critical9.8Unauthenticated Command Injection
EZPZ One Click Backup≤12.03.10No patch available
CVE-2014-3114—
Medium6.1Reflected Cross-Site Scripting
custom-tables≤3.4.4No patch available
CVE-2012-20003—
Medium6.1Cross-Site Scripting
BulletProof Security≤.48.9Update to .49
CVE-2013-3487—
Medium5.3Cross-Site Scripting
Redirection<2.2.10Update to 2.2.10
CVE-2011-4562—
Medium6.1Reflected Cross Site Scripting
WHOIS≤1.4.2.2Update to 1.4.2.3
CVE-2011-5194—
High8.8Cross-Site Request Forgery
Xhanch – My Twitter≤2.7.6Update to 2.7.7
CVE-2013-3253—
Medium5.3Information Disclosure
Portable phpMyAdmin≤1.4.1No patch available
CVE-2013-4454—
Medium6.1Cross-Site Scripting
Count per Day≤3.1.1Update to 3.2
CVE-2012-3434—
High8.8SQL Injection
Mingle Forum<1.0.33Update to 1.0.33
CVE-2012-5328—
High8.8Cross-Site Request Forgery
Stream Video Player≤1.4.1No patch available
CVE-2013-2706—
High7.3Authentication Bypass
Portable phpMyAdmin≤1.3.0Update to 1.3.1
CVE-2012-5469—
Medium6.3Cross-Site Request Forgery
WordPress Content Slide≤1.4.2No patch available
CVE-2013-2708—
High8.1Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery≤1.0.0Update to 1.1.0
CVE-2012-20002—
Medium6.4Stored Cross-Site Scripting
BuddyPress≤1.9.1Update to 1.9.2
CVE-2014-1888—
Medium6.1Open Redirection
WP Symposium≤13.04Update to 13.05
CVE-2013-2694—
Medium6.1Cross-Site Scripting
bib2html≤0.9.3No patch available
CVE-2014-3870—
Medium6.5Cross-Site Request Forgery
wp-html-sitemap≤1.2No patch available
CVE-2014-2675—
High8.8Remote Code Execution
WP Super Cache≤1.2Update to 1.3
CVE-2013-2009—
Medium6.1Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤2.0.3Update to 2.0.3.1
CVE-2013-5988—
High7.1Cross-Site Scripting
Polylang<1.5.2Update to 1.5.2
CVE-2014-4855—
Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.3.9Update to 5.3.9
CVE-2013-7479—
High8.8SQL Injection
Mingle Forum≤1.0.32.1Update to 1.0.33
CVE-2012-5327—

Search VulnCrest Radar

Jump to

Are you sure?