CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1349)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤0.4.4Update to 0.4.5
- Medium6.1Cross-Site Scripting
wp-media-player
≤0.8No patch available
- Medium6.1Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- High8.8Cross-Site Request Forgery
WP Activity Log
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
- Medium6.1Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
- Medium6.1DOM Cross-Site Scripting
Image Slider
<1.1.7Update to 1.1.7
- Medium6.1Cross-Site Scripting
XEN Carousel
≤0.12.2No patch available
- High7.5Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Cross-Site Scripting
WP Symposium
≤11.11.26Update to 11.12.08
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium6.1Multiple Cross-Site Scripting
WP Super Cache
≤1.3Update to 1.3.1
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.3.9Update to 5.3.9
- High7.3Unspecified Vulnerability
Image News Slider
≤3.2Update to 3.3
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- High7.1Cross-Site Scripting
WP Symposium
<13.04Update to 13.04
- Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories
≤1.1.1No patch available
- Medium5.3Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.3Information Disclosure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.0.2Update to 2.0.2