CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1348)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting DZS Video Gallery<7.95Update to 7.95	CVE-2014-3923	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Crowdsignal Dashboard – Polls, Surveys & more≤2.0.24Update to 2.0.25	CVE-2014-4856	—	Aug 1, 2014
High7.5	Local File Inclusion WP AmASIN – The Amazon Affiliate Shop≤0.9.6Update to 0.9.7	CVE-2014-4577	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.5.1Update to 5.5.2	CVE-2013-7477	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery underConstruction<1.09Update to 1.09	CVE-2013-2699	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Yoast Duplicate Post≤2.6Update to 3.0	CVE-2014-10378	—	Aug 1, 2014
Critical9.8	Local/Remote File Inclusion SlideDeck 2 Lite Responsive Content Slider≤2.3.3Update to 2.3.5	CVE-2013-7483	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Pie Register – User Registration, Profiles & Content Restriction≤1.30Update to 1.31	CVE-2013-4954	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.71Update to 2.72	CVE-2013-3261	—	Aug 1, 2014
Critical9.8	Remote Code Execution W3 Total Cache≤0.9.2.8Update to 0.9.2.9	CVE-2013-2010	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery to Cross-Site Scripting Contextual Related Posts≤1.8.6Update to 1.8.7	CVE-2013-2710	—	Aug 1, 2014
Medium5.3	Reflected Cross-Site Scripting Verification Code for Comments≤2.1.0No patch available	CVE-2014-4565	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP-Table Reloaded≤1.9.3Update to 1.9.4	CVE-2013-1463	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP Construction Mode≤1.8Update to 1.9	CVE-2014-4854	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WPCB≤2.4.8No patch available	CVE-2014-4581	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting HK Exif Tags≤1.11Update to 1.12	CVE-2014-100007	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1Update to 3.1.1	CVE-2012-0895	—	Aug 1, 2014
Medium5.3	Cross-Site Scripting Adminimize<1.7.22Update to 1.7.22	CVE-2011-5128	—	Aug 1, 2014
High7.2	Stored Cross-Site Scripting PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links<1.6.3Update to 1.6.3	CVE-2013-1636	—	Aug 1, 2014
High7.3	Authentication Bypass Portable phpMyAdmin≤1.3.0Update to 1.3.1	CVE-2012-5469	—	Aug 1, 2014
High8.8	Remote Code Execution WP Super Cache≤1.2Update to 1.3	CVE-2013-2009	—	Aug 1, 2014
High8.1	Unauthenticated Local File Inclusion Tinymce Thumbnail Gallery≤1.0.0Update to 1.1.0	CVE-2012-20002	—	Aug 1, 2014
Medium4.3	Cross-Site Request Forgery Calendar≤1.3.2Update to 1.3.3	CVE-2013-2698	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting via Search Parameter All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤2.0.3Update to 2.0.3.1	CVE-2013-5988	—	Aug 1, 2014
High8.8	SQL Injection Mingle Forum<1.0.33Update to 1.0.33	CVE-2012-5328	—	Aug 1, 2014
Medium6.1	Open Redirection WP Symposium≤13.04Update to 13.05	CVE-2013-2694	—	Aug 1, 2014
Medium6.1	Reflected Cross Site Scripting WHOIS≤1.4.2.2Update to 1.4.2.3	CVE-2011-5194	—	Aug 1, 2014
Medium6.5	Cross-Site Request Forgery wp-html-sitemap≤1.2No patch available	CVE-2014-2675	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting XEN Carousel≤0.12.2No patch available	CVE-2014-4602	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Platinum SEO≤1.3.7Update to 1.3.8	CVE-2013-5918	—	Aug 1, 2014

Medium6.1
Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
CVE-2014-3923Aug 1, 2014
Medium6.1
Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
CVE-2014-4856Aug 1, 2014
High7.5
Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
CVE-2014-4577Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
CVE-2013-7477Aug 1, 2014
High8.8
Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
CVE-2013-2699Aug 1, 2014
Medium6.1
Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
CVE-2014-10378Aug 1, 2014
Critical9.8
Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
CVE-2013-7483Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
CVE-2013-4954Aug 1, 2014
Medium6.1
Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
CVE-2013-3261Aug 1, 2014
Critical9.8
Remote Code Execution
W3 Total Cache
≤0.9.2.8Update to 0.9.2.9
CVE-2013-2010Aug 1, 2014
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
Contextual Related Posts
≤1.8.6Update to 1.8.7
CVE-2013-2710Aug 1, 2014
Medium5.3
Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
CVE-2014-4565Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
CVE-2013-1463Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
CVE-2014-4854Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
CVE-2014-4581Aug 1, 2014
Medium6.1
Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
CVE-2014-100007Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1Update to 3.1.1
CVE-2012-0895Aug 1, 2014
Medium5.3
Cross-Site Scripting
Adminimize
<1.7.22Update to 1.7.22
CVE-2011-5128Aug 1, 2014
High7.2
Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
CVE-2013-1636Aug 1, 2014
High7.3
Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
CVE-2012-5469Aug 1, 2014
High8.8
Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
CVE-2013-2009Aug 1, 2014
High8.1
Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
CVE-2012-20002Aug 1, 2014
Medium4.3
Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
CVE-2013-2698Aug 1, 2014
Medium6.1
Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
CVE-2013-5988Aug 1, 2014
High8.8
SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
CVE-2012-5328Aug 1, 2014
Medium6.1
Open Redirection
WP Symposium
≤13.04Update to 13.05
CVE-2013-2694Aug 1, 2014
Medium6.1
Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
CVE-2011-5194Aug 1, 2014
Medium6.5
Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
CVE-2014-2675Aug 1, 2014
Medium6.1
Cross-Site Scripting
XEN Carousel
≤0.12.2No patch available
CVE-2014-4602Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
CVE-2013-5918Aug 1, 2014