VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 136)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 136)
SeverityVulnerabilityCVEInstallsPublished
High7.5Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
HivePress Authentication≤1.1.4Update to 1.1.5
CVE-2026-18056—
Critical9.8Unauthenticated Account Takeover via '_acf_objects' Object Identifier
ACF Frontend Admin by DynamiApps≤3.29.12Update to 3.29.13
CVE-2026-75816—
Critical9.8Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
MemberDash≤1.8.5Update to 1.8.6
CVE-2026-16310—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder<5.9.8Update to 5.9.8
CVE-2026-84021—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Greenshift – animation and page builder blocks<13.2.0Update to 13.2.0
CVE-2026-83544—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VikWidgetsLoader – Collection of Widgets<1.12.0Update to 1.12.0
CVE-2026-84899—
Medium4.3Authenticated (Contributor+) Information Exposure
The Events Calendar<6.17.3.1Update to 6.17.3.1
CVE-2026-84745—
Medium4.96.2.5 - Authenticated (Editor+) SQL Injection
Kirki – Freeform Page Builder, Website Builder & Customizer6.0.0 – 6.2.5Update to 6.3.0
CVE-2026-84221—
Medium4.36.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Kirki – Freeform Page Builder, Website Builder & Customizer6.0.0 – 6.2.5Update to 6.3.0
CVE-2026-84225—
Medium4.3Missing Authorization
Search Atlas SEO – OTTO AI SEO Automation for WordPress<2.6.24Update to 2.6.24
CVE-2026-15247—
Medium5.3Unauthenticated Information Exposure
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam<4.2.3Update to 4.2.3
CVE-2026-81348—
Medium6.5Authenticated (Contributor+) Path Traversal
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce<4.1.21Update to 4.1.21
CVE-2026-84898—
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Greenshift – animation and page builder blocks<13.2.0Update to 13.2.0
CVE-2026-83543—
Medium4.95.0.0 - Authenticated (Administrator+) Path Traversal
JCH Optimize4.2.1 – 5.0.0Update to 5.0.1
CVE-2025-15693—
Medium6.42.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates1.18.0 – 2.3.3Update to 3.4.0
CVE-2026-82846—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
CatFolders Document Gallery & PDF Library<2.0.7Update to 2.0.7
CVE-2026-84930—
Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce<4.1.22Update to 4.1.22
CVE-2026-84901—
Medium4.34.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News4.0.0 – 4.0.7Update to 4.0.8
CVE-2026-78150—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder<51.1.77Update to 51.1.77
CVE-2026-84896—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder<5.9.8Update to 5.9.8
CVE-2026-84022—
Medium6.5Authenticated (Contributor+) SQL Injection
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch<2.1.0Update to 2.1.0
CVE-2026-84937—
Medium5.3Unauthenticated Insecure Direct Object Reference
Accept Stripe Payments<2.1.4Update to 2.1.4
CVE-2026-81424—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode<3.0.3Update to 3.0.3
CVE-2026-84931—
Medium4.34.6.3 - Missing Authorization
EmbedPress4.6.0 – 4.6.3Update to 4.6.4
CVE-2026-84926—
Critical9.82.3.22 - Unauthenticated Hook Injection
Post Grid2.2.85 – 2.3.22Update to 2.3.23
CVE-2024-11080—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Pods – Custom Content Types and Fields≤3.3.9.1Update to 3.3.9.2
CVE-2026-76573—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
FooGallery Photo Gallery : Image, Video & Masonry Galleries≤3.3.2Update to 3.3.3
CVE-2026-85414—
High7.2Unauthenticated Stored Cross-Site Scripting via IP Address Header
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics≤1.10.2Update to 1.10.3
CVE-2026-83625—
Medium6.1Reflected Cross-Site Scripting via 'formData[id]' Parameter
Unlimited Elements for Elementor≤2.0.17Update to 2.0.18
CVE-2026-75586—
Medium6.5Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
WP File Download≤6.3.8Update to 6.3.9
CVE-2026-14975—

Search VulnCrest Radar

Jump to

Are you sure?