CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 135)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Tangible: Loops & Logic
≤4.2.0Update to 4.3.0
- Medium4.9Authenticated (Administrator+) SQL Injection
Quentn WP
≤1.2.14Update to 1.2.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
≤3.0.8Update to 3.0.9
- Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium5.3Unauthenticated Information Exposure
Payment Plugins for PayPal WooCommerce
≤2.0.25Update to 2.0.26
- Medium4.34.4.1 - Missing Authorization to Information Exposure
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
4.0.2 – 4.4.1Update to 4.4.2
- Medium6.50.1.8 - Unauthenticated Arbitrary Shortcode Execution
LukasApps CAPTCHA tools for Contact Form 7
0.1.7 – 0.1.8Update to 0.1.9
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.6Update to 3.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
HT Menu – WordPress Mega Menu Builder for Elementor
<1.2.7Update to 1.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JCH Optimize
<6.0.1Update to 6.0.1
- Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.1Unauthenticated Open Redirect
Groundhogg — CRM, Newsletters, and Marketing Automation
<4.7.2Update to 4.7.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Hustle – Email Marketing, Lead Generation, Optins, Popups
<7.8.14.2Update to 7.8.14.2
- Medium4.3Missing Authorization
Payment Plugins for PayPal WooCommerce
≤2.0.25Update to 2.0.26
- Medium5.3Unauthenticated Information Exposure
Payment Plugins for Stripe WooCommerce
≤4.0.11Update to 4.0.12
- High7.33.0.2 - Unauthenticated Privilege Escalation
SEO Flow by LupsOnline
3.0.0 – 3.0.2Update to 3.0.3
- High7.5Missing Authorization to Unauthenticated Stripe Credentials Update
Event Tickets and Registration
≤5.27.4Update to 5.27.4.1
- Medium5.3Unauthenticated Information Exposure
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Anti-Spam, Spam FireWall by CleanTalk
<6.87Update to 6.87
- High8.8Authenticated (Subscriber+) Arbitrary Account Email Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.6.3Update to 4.6.3
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.4Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
Flamingo
≤2.6.2Update to 2.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
Powerkit – Supercharge your WordPress Site
≤3.0.4Update to 3.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
<5.9.9Update to 5.9.9
- Medium5.3Missing Authorization to Unauthenticated Purchase Verification Bypass
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.1.7Update to 3.1.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.15.7Update to 3.15.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.2.0Update to 2.2.1