CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 19)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress plugins- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer
Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance
≤1.7No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters
Mobile builder
≤1.4.2No patch available
- High8.8Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
Import and export users and customers
≤2.5.11Update to 2.5.12
- High7.2Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field
Slim Jetpack
≤2.7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.3Update to 1.44.4
- Medium6.5Authenticated (Author+) SQL Injection
CatFolders – WordPress Media Library Folders & Categories
≤2.5.6Update to 2.5.7
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- High7.5Unauthenticated SQL Injection
Mail Mage
≤0.0.25No patch available
- Medium4.3Authenticated (Vendor+) Business Logic Flaw
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium6.3Authenticated (Contributor+) Privilege Escalation
Surfer – WordPress Plugin
≤1.8.1.758Update to 1.8.1.759
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ShopEngine Gutenberg WooCommerce Builder Blocks Addon – All in One WooCommerce Solution
≤2.4.3Update to 2.4.4
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Cool Media Filter
≤1.0.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤3.13.6Update to 3.13.7
- Medium4.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.7.1Update to 8.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Posts Table with Search & Sort
≤1.4.14Update to 1.4.15
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.0.0Update to 5.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.3Update to 3.1.4
- Medium5.3Missing Authorization
ClickCease Click Fraud Protection
≤3.3.0Update to 3.3.1
- Medium5.3Missing Authorization
Better Search – Relevant search results for WordPress
≤4.5.2Update to 4.5.3
- Medium5.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.0.0Update to 5.1.0
- Critical9.8Unauthenticated Remote Code Execution
WP Libre Form
≤1.5.0.1No patch available
- High8.1Authenticated (Accounting Manager+) Arbitrary File Deletion
Ever Accounting – Accounting & Invoicing Solution for Small Businesses
≤2.3.2Update to 2.3.3
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.3Update to 1.58.4
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.3Update to 1.58.4
- Critical9.8Unauthenticated Remote Code Execution
Static Snapshot
≤0.2.1No patch available