CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1352)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | SQL Injection | CVE-2014-5185 | — | |
| Critical9.8 | SQL Injection | CVE-2014-4938 | — | |
| High7.5 | Directory Traversal | CVE-2014-4940 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2014-5182 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4526 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| High7.5 | Path Traversal | CVE-2014-4937 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4520 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2014-4939 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4605 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4528 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4544 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4534 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4576 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4535 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4551 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4583 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4522 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4542 | — |
- High8.8SQL Injection
quartz
≤1.01.1No patch available
- Critical9.8SQL Injection
WP Rss Poster
≤1.0.0No patch available
- High7.5Directory Traversal
Tera Charts
≤0.1Update to 1.0
- High8.8Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
- Medium6.1Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
- High7.2SQL Injection
stripshow
≤2.5.2No patch available
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- High7.5Path Traversal
BookX
≤1.7No patch available
- Medium6.1Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- High7.2Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- Medium6.1Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- Medium6.1Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
- Medium6.1Reflected Cross-Site Scripting
HTML5 Video Player with Playlist
≤2.4.0No patch available
- Medium6.1Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
- Medium6.1Cross-Site Scripting
Import Legacy Media
≤0.1No patch available
- Medium6.1Cross-Site Scripting
Social Connect
≤0.10.1Update to 0.10.2
- Medium6.1Cross-Site Scripting
WP-Contact
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
- Medium6.1Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available