CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 1373)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress plugins| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Arbitrary Email Content Change | CVE-2005-2109 | — | |
| High8.8 | SQL Injection | CVE-2005-2108 | — | |
| High7.3 | Sensitive Information Disclosure | CVE-2005-2110 | — | |
| High7.2 | Cross-Site Scripting | CVE-2005-2107 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2005-1102 | — | |
| High8.8 | SQL Injection | CVE-2005-1810 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2005-1688 | — | |
| High8.8 | SQL Injection | CVE-2005-1687 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2004-1559 | — | |
| Medium5.3 | HTTP Response Splitting | CVE-2004-1584 | — | |
| High8.8 | SQL Injection | CVE-2003-1598 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2003-1599 | — |
- Medium5.3Arbitrary Email Content Change
WordPress
≤1.5.1.2Update to 1.5.1.3
- High8.8SQL Injection
WordPress
<1.5.1.3Update to 1.5.1.3
- High7.3Sensitive Information Disclosure
WordPress
≤1.5.1.2Update to 1.5.1.3
- High7.2Cross-Site Scripting
WordPress
≤1.5.1.2Update to 1.5.1.3
- Medium6.4Stored Cross-Site Scripting
WordPress
≤1.5.1Update to 1.5.1.2
- High8.8SQL Injection
WordPress
≤1.5.1.1Update to 1.5.1.2
- Medium5.3Full Path Disclosure
WordPress
<1.5.1Update to 1.5.1
- High8.8SQL Injection
WordPress
<1.5.1Update to 1.5.1
- Medium6.1Cross-Site Scripting
WordPress
<1.2Update to 1.2
- Medium5.3HTTP Response Splitting
WordPress
<1.2.1Update to 1.2.1
- High8.8SQL Injection
WordPress
<0.72Update to 0.72
- Critical9.8Remote File Inclusion
WordPress
≤0.70Update to 0.71