CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 149)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist
<3.1.4Update to 3.1.4
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
≤0.4.62Update to 0.4.63
- Medium4.3Missing Authorization
Advanced Custom Fields: Extended
≤0.9.2.6Update to 0.9.2.7
- High7.5Unauthenticated SQL Injection via 'referer' Parameter
wpForo Forum
≤2.4.17Update to 3.0.0
- High7.2Unauthenticated Open Redirect
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.43Update to 3.7.43
- High7.3Missing Authorization to Unauthenticated Settings Update
HEL Online Classroom: AI-powered Online Classrooms
≤1.0.3No patch available
- Medium5.3Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.4Update to 3.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.33Update to 5.9.34
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
All-in-One WP Migration Unlimited Extension
≤2.84Update to 2.85
- High7.2Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
Customer Reviews for WooCommerce
≤5.106.0Update to 5.107.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
GiveWP – Donation Plugin and Fundraising Platform
≤4.14.4Update to 4.14.5
- Medium6.3Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
<4.21.1Update to 4.21.1
- Medium5.3Unauthenticated Payment Bypass
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.40Update to 3.7.40
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- High7.2Authenticated (Administrator+) Remote Code Execution
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.57.0.5Update to 1.57.0.5
- High7.5Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
Formidable Charts
≤2.0.1Update to 2.0.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<4.0.7Update to 4.0.7
- Medium5.3Unauthenticated Limited File Upload
Shared Files – File Upload & Download Manager
<1.7.67Update to 1.7.67
- Medium5.3Unauthenticated Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.22Update to 4.1.22
- Critical9.8Unauthenticated Arbitrary Zero-Argument Function Invocation
Tutor LMS – eLearning and online course solution
≤4.0.5Update to 4.0.6
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
Timetics – Appointment Booking Calendar & Scheduling
<1.0.62Update to 1.0.62
- Medium5.3Missing Authorization
Kirki – Freeform Page Builder, Website Builder & Customizer
<6.0.14Update to 6.0.14
- Medium4.34.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
2.2.0 – 4.0.6Update to 4.0.7
- Medium6.5Authenticated (Contributor+) SQL Injection
Suggestion Engine for WooCommerce
≤2.0.11Update to 2.0.12
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
<2.4.7Update to 2.4.7
- High7.2Authenticated (Editor+) Arbitrary File Upload
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium4.9Authenticated (Administrator+) SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.9.4Update to 6.0.9.4
- Low2.7Missing Authorization
Fluent Player Pro
≤1.3.2Update to 1.4.0