CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 150)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.23Update to 2.4.24
- Medium4.3Missing Authorization
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.67Update to 3.1.69
- Medium4.3Cross-Site Request Forgery
Fluent Booking Pro
≤2.2.4Update to 2.2.5
- Medium4.3Cross-Site Request Forgery
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.176Update to 2.8.177
- Medium4.3Authenticated (Subscriber+) Information Exposure
SureFeedback Client Site
≤1.2.12Update to 1.2.13
- Medium5.3Missing Authorization
Noptin – Newsletter, New Post Notifications & Email Automation
<4.3.3Update to 4.3.3
- Critical9.8Authentication Bypass to Administrator
SmilePass Selfie Login
≤1.0.2No patch available
- Medium4.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.20Update to 3.21
- Medium5.3Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
<3.0.18Update to 3.0.18
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium5.3Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
WCFM Marketplace – Multivendor Marketplace for WooCommerce
<3.8.2Update to 3.8.2
- Medium6.11.5.0 - Unauthenticated Cache Poisoning
WP Fastest Cache – WordPress Cache Plugin
0.8.7.7 – 1.5.0Update to 1.5.1
- Medium6.6Authenticated (Editor+) PHP Object Injection
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium5.3Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1066Update to 1.7.1066
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1066Update to 1.7.1066
- Medium6.3Missing Authorization to Authenticated (Subscriber+) Settings Change
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
4.0.0-beta.1 – 4.0.0-beta.1Update to 4.0.1
- High8.1Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
Classified Listing - Mobile Number Verification
≤1.6.0Update to 1.7.0
- Critical9.8Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.8Update to 1.17.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Reviews and Rating – Google Reviews
≤5.10Update to 6.0
- Critical9.8Unauthenticated Remote Code Execution via Arbitrary File Write
Avada (Fusion) Builder
≤3.16Update to 3.16.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.33.1Update to 6.34
- High7.2Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
WP Fastest Cache – WordPress Cache Plugin
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated Account Takeover via Password Reset Link Disclosure
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.1Update to 3.3.2
- High7.5Unauthenticated SQL Injection
Beautiful taxonomy filters
≤2.4.6Update to 2.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Realtyna Organic IDX plugin + WPL Real Estate
≤5.4.1Update to 5.4.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Stock Update
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
≤0.4.69No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
Greenshift – animation and page builder blocks
≤12.8.9Update to 12.9.0
- High7.5Unauthenticated SQL Injection
Visitor Traffic Real Time Statistics pro
≤11.17Update to 11.18
- High7.2Unauthenticated Stored Cross-Site Scripting
CP Media Player – Audio Player and Video Player
≤1.3.0Update to 1.3.1
- Medium5.3Missing Authorization
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
≤0.4.62Update to 0.4.63