CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 1360)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins

WordPress SQL Injection vulnerabilities (page 1360)
Severity	Vulnerability	CVE	Installs	Published
Low3.8	Remote Code Execution via Remote File Inclusion Advanced Custom Fields (ACF®)≤3.5.1Update to 3.5.2	CVE-2012-10025	—	Jan 3, 2013
High8.8	Cross-Site Request Forgery Mingle Forum≤1.0.34Update to 1.0.35	CVE-2013-0736	—	Jan 2, 2013
Medium5.4	Missing Session Cookie Expiration WordPress<4.0Update to 4.0	CVE-2012-5868	—	Dec 27, 2012
High8.8	Cross-Site Request Forgery Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5178	—	Dec 14, 2012
Medium6.1	Cross-Site Scripting Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5177	—	Dec 14, 2012
Medium6.1	Reflected Cross-Site Scripting BuddyStream≤3.6.2Update to 3.6.3	CVE-2012-10007	—	Dec 4, 2012
Medium6.1	Cross-Site Scripting Video Lead Form<0.6Update to 0.6	CVE-2012-6312	—	Nov 26, 2012
Medium5.3	Sensitive Information Disclosure Simple Gmail Login<1.1.4Update to 1.1.4	CVE-2012-6313	—	Nov 24, 2012
Medium6.1	Cross-Site Scripting Advanced Text Widget≤2.0.1Update to 2.0.2	CVE-2011-4618	—	Nov 21, 2012
Medium6.1	Cross-Site Scripting Uk Cookie≤1.1No patch available	CVE-2012-5856	—	Nov 13, 2012
Medium6.1	Cross-Site Scripting Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤1.9.6Update to 1.9.7	CVE-2012-3414	—	Nov 9, 2012
Critical9.8	Unauthenticated SQL Injection Cardoza AJAX Search<1.3Update to 1.3	CVE-2012-5853	—	Nov 6, 2012
High7.3	SQL Injection All Video Gallery Plugin for WordPress<1.2Update to 1.2	CVE-2012-6653	—	Nov 2, 2012
Medium6.1	Cross Site Scripting via post_title parameter Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤2.1.1Update to 2.2	CVE-2012-6692	—	Oct 31, 2012
High7.1	Cross-Site Scripting White Label CMS<1.5.1Update to 1.5.1	CVE-2012-5388	—	Oct 21, 2012
High7.1	Reflected Cross-Site Scripting White Label CMS<1.5.1Update to 1.5.1	CVE-2012-5387	—	Oct 21, 2012
Medium6.1	Cross-Site Scripting MF Gig Calendar≤0.9.4.1Update to 0.9.5	CVE-2012-4242	—	Sep 23, 2012
Medium6.1	Cross-Site Scripting WHOIS≤1.4.2.4No patch available	CVE-2011-5193	—	Sep 23, 2012
High7.5	Information Disclosure via Arbitrary File Downloads simple-download-button-shortcode1.0 – 1.0Update to 1.1	CVE-2012-10016	—	Sep 17, 2012
High8.8	Cross-Site Request Forgery DVS Custom Notification≤1.0.1No patch available	CVE-2012-4921	—	Sep 14, 2012
Low3.8	Missing Authorization Checks WordPress≤3.4.1Update to 3.4.2	CVE-2012-4422	—	Sep 6, 2012
Medium6.4	Cross-Site Scripting WordPress≤3.4.1Update to 3.4.2	CVE-2012-3383	—	Sep 6, 2012
Medium6.3	Missing Authorization Checks on create_post WordPress<3.4.2Update to 3.4.2	CVE-2012-4421	—	Sep 6, 2012
Medium6.1	Reflected Cross-Site Scripting Download Monitor≤3.3.5.8Update to 3.3.5.9	CVE-2012-4768	—	Sep 6, 2012
Medium6.1	Multiple Cross-Site Scripting quick-post-widget≤1.9.1No patch available	CVE-2012-4226	—	Aug 10, 2012
High7.2	Cross-Site Scripting Postie≤1.4.9Update to 1.4.10	CVE-2012-2580	—	Aug 8, 2012
Medium6.1	Cross-Site Scripting ThreeWP Email Reflector<1.16Update to 1.16	CVE-2012-2572	—	Aug 8, 2012
High7.2	Cross-Site Scripting mini-mail-dashboard-widget<1.43Update to 1.43	CVE-2012-2583	—	Aug 8, 2012
Medium6.1	Cross-Site Scripting WP SimpleMail≤1.0.6No patch available	CVE-2012-2579	—	Aug 8, 2012
High7.5	Directory Traversal Vitamin<1.1.0Update to 1.1.0	CVE-2012-6651	—	Aug 7, 2012

Low3.8
Remote Code Execution via Remote File Inclusion
Advanced Custom Fields (ACF®)
≤3.5.1Update to 3.5.2
CVE-2012-10025Jan 3, 2013
High8.8
Cross-Site Request Forgery
Mingle Forum
≤1.0.34Update to 1.0.35
CVE-2013-0736Jan 2, 2013
Medium5.4
Missing Session Cookie Expiration
WordPress
<4.0Update to 4.0
CVE-2012-5868Dec 27, 2012
High8.8
Cross-Site Request Forgery
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5178Dec 14, 2012
Medium6.1
Cross-Site Scripting
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5177Dec 14, 2012
Medium6.1
Reflected Cross-Site Scripting
BuddyStream
≤3.6.2Update to 3.6.3
CVE-2012-10007Dec 4, 2012
Medium6.1
Cross-Site Scripting
Video Lead Form
<0.6Update to 0.6
CVE-2012-6312Nov 26, 2012
Medium5.3
Sensitive Information Disclosure
Simple Gmail Login
<1.1.4Update to 1.1.4
CVE-2012-6313Nov 24, 2012
Medium6.1
Cross-Site Scripting
Advanced Text Widget
≤2.0.1Update to 2.0.2
CVE-2011-4618Nov 21, 2012
Medium6.1
Cross-Site Scripting
Uk Cookie
≤1.1No patch available
CVE-2012-5856Nov 13, 2012
Medium6.1
Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.6Update to 1.9.7
CVE-2012-3414Nov 9, 2012
Critical9.8
Unauthenticated SQL Injection
Cardoza AJAX Search
<1.3Update to 1.3
CVE-2012-5853Nov 6, 2012
High7.3
SQL Injection
All Video Gallery Plugin for WordPress
<1.2Update to 1.2
CVE-2012-6653Nov 2, 2012
Medium6.1
Cross Site Scripting via post_title parameter
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤2.1.1Update to 2.2
CVE-2012-6692Oct 31, 2012
High7.1
Cross-Site Scripting
White Label CMS
<1.5.1Update to 1.5.1
CVE-2012-5388Oct 21, 2012
High7.1
Reflected Cross-Site Scripting
White Label CMS
<1.5.1Update to 1.5.1
CVE-2012-5387Oct 21, 2012
Medium6.1
Cross-Site Scripting
MF Gig Calendar
≤0.9.4.1Update to 0.9.5
CVE-2012-4242Sep 23, 2012
Medium6.1
Cross-Site Scripting
WHOIS
≤1.4.2.4No patch available
CVE-2011-5193Sep 23, 2012
High7.5
Information Disclosure via Arbitrary File Downloads
simple-download-button-shortcode
1.0 – 1.0Update to 1.1
CVE-2012-10016Sep 17, 2012
High8.8
Cross-Site Request Forgery
DVS Custom Notification
≤1.0.1No patch available
CVE-2012-4921Sep 14, 2012
Low3.8
Missing Authorization Checks
WordPress
≤3.4.1Update to 3.4.2
CVE-2012-4422Sep 6, 2012
Medium6.4
Cross-Site Scripting
WordPress
≤3.4.1Update to 3.4.2
CVE-2012-3383Sep 6, 2012
Medium6.3
Missing Authorization Checks on create_post
WordPress
<3.4.2Update to 3.4.2
CVE-2012-4421Sep 6, 2012
Medium6.1
Reflected Cross-Site Scripting
Download Monitor
≤3.3.5.8Update to 3.3.5.9
CVE-2012-4768Sep 6, 2012
Medium6.1
Multiple Cross-Site Scripting
quick-post-widget
≤1.9.1No patch available
CVE-2012-4226Aug 10, 2012
High7.2
Cross-Site Scripting
Postie
≤1.4.9Update to 1.4.10
CVE-2012-2580Aug 8, 2012
Medium6.1
Cross-Site Scripting
ThreeWP Email Reflector
<1.16Update to 1.16
CVE-2012-2572Aug 8, 2012
High7.2
Cross-Site Scripting
mini-mail-dashboard-widget
<1.43Update to 1.43
CVE-2012-2583Aug 8, 2012
Medium6.1
Cross-Site Scripting
WP SimpleMail
≤1.0.6No patch available
CVE-2012-2579Aug 8, 2012
High7.5
Directory Traversal
Vitamin
<1.1.0Update to 1.1.0
CVE-2012-6651Aug 7, 2012