CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1353)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 1353)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	CBI Referral Manager <= 1.2.1 Cross-Site Scripting CBI Referral Manager≤1.2.1No patch available	CVE-2014-4517	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting dsSearchAgent: WordPress Edition<1.0-beta10No patch available	CVE-2014-4522	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting WP-Planet≤0.1No patch available	CVE-2014-4592	—	May 25, 2014
Medium6.1	Cross-Site Scripting zeenshare≤1.0.1No patch available	CVE-2014-4606	—	May 25, 2014
Medium6.1	Multiple Cross-Site Scripting WP e-Commerce Swipe plugin≤3.1.0No patch available	CVE-2014-4559	—	May 25, 2014
Medium6.1	Cross-Site Scripting Infusionsoft Gravity Forms Add-on<1.5.7Update to 1.5.7	CVE-2014-4536	—	May 25, 2014
High7.1	Cross-Site Scripting WooCommerce SagePay Direct Payment Gateway<0.1.6.7Update to 0.1.6.7	CVE-2014-4549	—	May 25, 2014
Medium6.1	Cross-Site Scripting Spotlight≤4.7No patch available	CVE-2014-4552	—	May 25, 2014
Medium6.1	Cross-Site Scripting Pay Per Media Player≤1.24No patch available	CVE-2014-4543	—	May 25, 2014
Medium6.1	Cross-Site Scripting swipe-hq-checkout-for-eshop≤3.7.0No patch available	CVE-2014-4556	—	May 25, 2014
Medium6.1	Cross-Site Scripting Diverse Solutions IDX Real Estate Listings & MLS Search<2.1.1Update to 2.1.1	CVE-2014-4521	—	May 25, 2014
Medium6.4	Cross-Site Scripting shortcode-ninja≤1.4No patch available	CVE-2014-4550	—	May 25, 2014
Medium6.1	Cross-Site Scripting GarageSale<1.2.3Update to 1.2.3	CVE-2014-4532	—	May 25, 2014
High7.1	Cross-Site Scripting Toolpage≤1.6.1No patch available	CVE-2014-4560	—	May 25, 2014
Medium6.1	Stored Cross-Site Scripting WP Ultimate Email Marketer≤1.1.0No patch available	CVE-2014-4600	—	May 25, 2014
Medium6.1	Cross-Site Scripting verwei.se – WordPress – Twitter≤1.0.2No patch available	CVE-2014-4566	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting HTML5 Video Player with Playlist≤2.4.0No patch available	CVE-2014-4534	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Votecount For Balatarin≤0.1.1No patch available	CVE-2014-4572	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Local Weather≤1.0No patch available	CVE-2014-4561	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-RSS-Spreadshirt-3DCube-Gallery≤1.3No patch available	CVE-2014-4553	—	May 25, 2014
High7.1	Cross-Site Scripting GEO Redirector≤1.0.1No patch available	CVE-2014-4533	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Movies≤0.6No patch available	CVE-2014-4539	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Business Directory≤1.0.2No patch available	CVE-2014-4599	—	May 25, 2014
Medium6.1	Cross-Site Scripting Conversion Ninjaall versionsNo patch available	CVE-2014-4017	—	May 22, 2014
High8.8	SQL Injection Pinpoint Booking System – Legacy version<1.3Update to 1.3	CVE-2014-3210	—	May 21, 2014
Medium6.1	3.9.001 - Cross-Site Scripting iMember360is3.8.012 – <3.9.002Update to 3.9.002	CVE-2014-3842	—	May 14, 2014
High8.8	Cross-Site Request Forgery Login rebuilder<1.2.0Update to 1.2.0	CVE-2014-3882	—	May 14, 2014
High8.8	Cross-Site Request Forgery Photo Gallery by 10Web – Mobile-Friendly Image Gallery<1.2.42Update to 1.2.42	CVE-2015-9380	—	May 7, 2014
Medium4.3	Cross-Site Request Forgery Search Everything<8.1.1Update to 8.1.1	CVE-2014-3843	—	May 6, 2014
Medium4.3	Cross-Site Request Forgery TinyMCE Color Picker<1.2Update to 1.2	CVE-2014-3845	—	May 1, 2014

Medium6.1
CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
CVE-2014-4517May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
CVE-2014-4522May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
WP-Planet
≤0.1No patch available
CVE-2014-4592May 25, 2014
Medium6.1
Cross-Site Scripting
zeenshare
≤1.0.1No patch available
CVE-2014-4606May 25, 2014
Medium6.1
Multiple Cross-Site Scripting
WP e-Commerce Swipe plugin
≤3.1.0No patch available
CVE-2014-4559May 25, 2014
Medium6.1
Cross-Site Scripting
Infusionsoft Gravity Forms Add-on
<1.5.7Update to 1.5.7
CVE-2014-4536May 25, 2014
High7.1
Cross-Site Scripting
WooCommerce SagePay Direct Payment Gateway
<0.1.6.7Update to 0.1.6.7
CVE-2014-4549May 25, 2014
Medium6.1
Cross-Site Scripting
Spotlight
≤4.7No patch available
CVE-2014-4552May 25, 2014
Medium6.1
Cross-Site Scripting
Pay Per Media Player
≤1.24No patch available
CVE-2014-4543May 25, 2014
Medium6.1
Cross-Site Scripting
swipe-hq-checkout-for-eshop
≤3.7.0No patch available
CVE-2014-4556May 25, 2014
Medium6.1
Cross-Site Scripting
Diverse Solutions IDX Real Estate Listings & MLS Search
<2.1.1Update to 2.1.1
CVE-2014-4521May 25, 2014
Medium6.4
Cross-Site Scripting
shortcode-ninja
≤1.4No patch available
CVE-2014-4550May 25, 2014
Medium6.1
Cross-Site Scripting
GarageSale
<1.2.3Update to 1.2.3
CVE-2014-4532May 25, 2014
High7.1
Cross-Site Scripting
Toolpage
≤1.6.1No patch available
CVE-2014-4560May 25, 2014
Medium6.1
Stored Cross-Site Scripting
WP Ultimate Email Marketer
≤1.1.0No patch available
CVE-2014-4600May 25, 2014
Medium6.1
Cross-Site Scripting
verwei.se – WordPress – Twitter
≤1.0.2No patch available
CVE-2014-4566May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
HTML5 Video Player with Playlist
≤2.4.0No patch available
CVE-2014-4534May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Votecount For Balatarin
≤0.1.1No patch available
CVE-2014-4572May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Local Weather
≤1.0No patch available
CVE-2014-4561May 25, 2014
Medium6.1
Cross-Site Scripting
WP-RSS-Spreadshirt-3DCube-Gallery
≤1.3No patch available
CVE-2014-4553May 25, 2014
High7.1
Cross-Site Scripting
GEO Redirector
≤1.0.1No patch available
CVE-2014-4533May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Movies
≤0.6No patch available
CVE-2014-4539May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Business Directory
≤1.0.2No patch available
CVE-2014-4599May 25, 2014
Medium6.1
Cross-Site Scripting
Conversion Ninja
all versionsNo patch available
CVE-2014-4017May 22, 2014
High8.8
SQL Injection
Pinpoint Booking System – Legacy version
<1.3Update to 1.3
CVE-2014-3210May 21, 2014
Medium6.1
3.9.001 - Cross-Site Scripting
iMember360is
3.8.012 – <3.9.002Update to 3.9.002
CVE-2014-3842May 14, 2014
High8.8
Cross-Site Request Forgery
Login rebuilder
<1.2.0Update to 1.2.0
CVE-2014-3882May 14, 2014
High8.8
Cross-Site Request Forgery
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.42Update to 1.2.42
CVE-2015-9380May 7, 2014
Medium4.3
Cross-Site Request Forgery
Search Everything
<8.1.1Update to 8.1.1
CVE-2014-3843May 6, 2014
Medium4.3
Cross-Site Request Forgery
TinyMCE Color Picker
<1.2Update to 1.2
CVE-2014-3845May 1, 2014