CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1351)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.1 | Cross-Site Scripting | CVE-2014-4598 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4586 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4548 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4570 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4573 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4591 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4585 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4595 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4519 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4540 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4546 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4557 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4564 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4516 | — | |
| Critical9.8 | SQL Injection | CVE-2014-4938 | — | |
| High8.8 | SQL Injection | CVE-2014-5185 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4558 | — |
- High7.1Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
- Medium6.1Cross-Site Scripting
wp-football
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
- High7.1Cross-Site Scripting
Walk Score Plugin
≤0.5.5No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WP-FaceThumb
≤1.0No patch available
- Medium6.1Multiple Cross-Site Scripting
wp-restful
≤0.1No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- High7.1Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
- Medium6.1Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
- Medium6.1Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- Medium6.1Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
- Critical9.8SQL Injection
WP Rss Poster
≤1.0.0No patch available
- High8.8SQL Injection
quartz
≤1.01.1No patch available
- Medium6.1Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available