CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 148)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.0.1Update to 1.57.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.3Update to 3.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.10Update to 4.2.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
Smart Slider 3
≤3.5.1.38Update to 3.5.1.39
- High7.3Unauthenticated Privilege Escalation
RestrictMate – Restrict Page, Post and any Content ( Content Restriction and Membership Plugin)
<1.3.0Update to 1.3.0
- Medium4.3Authenticated (Subscriber+) Membership Plan Deletion
ACF Frontend Admin by DynamiApps
<3.29.11Update to 3.29.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
MW WP Form
<5.1.5Update to 5.1.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.12.4Update to 1.12.5
- High7.2Authenticated (Administrator+) Remote Code Execution
Defender Security – Malware Scanner, Login Security & Firewall
<6.2.0Update to 6.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
WP Rocket
≤3.21.0.1Update to 3.21.1
- High8.8Authenticated (Author+) Remote Code Execution
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.276Update to 1.0.277
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.9Update to 2.6.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
<8.5.5Update to 8.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Uncode
≤2.12.7Update to 2.12.8
- Medium5.3Missing Authorization to Unauthenticated Settings Change
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
<4.1.18Update to 4.1.18
- High7.2Authenticated (Administrator+) Remote Code Execution
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
<4.3.2Update to 4.3.2
- Medium5.3Insufficient Authorization
Newsletters
<4.17Update to 4.17
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion
MStore API – Create Native Android & iOS Apps On The Cloud
<4.21.1Update to 4.21.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
<2.21.0Update to 2.21.0
- Medium4.3Cross-Site Request Forgery
Real Estate Papi
≤1.0.5No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Workeera – AI Job Board with Applicant Tracking System (ATS)
<1.0.6Update to 1.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.2Update to 3.8.14.3
- High7.5Unauthenticated Arbitrary File Read
爱采集数据采集和发布插件
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery
UpdraftPlus Premium
<1.26.7Update to 1.26.7
- Medium6.53.7.1 - Authenticated (Subscriber+) Arbitrary File Read
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
3.3.3 – 3.7.1Update to 3.7.2
- Medium5.3Unauthenticated Captcha Bypass
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.0Update to 6.8.1
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Workeera – AI Job Board with Applicant Tracking System (ATS)
<1.0.6Update to 1.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
Booking for Appointments and Events Calendar – Amelia
≤2.2Update to 2.2.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 's' Parameter
ElementsKit Pro
≤4.10.1Update to 4.10.2
- High7.5Unauthenticated Denial of Service
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.2.0Update to 4.3.0