CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 36)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
GEO my WP
≤4.5.5.5Update to 4.5.5.7
- Medium4.3Missing Authorization
HANDMADE – Dropshipping for Etsy and WooCommerce
≤1.0.10Update to 1.0.11
- Medium5.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyPress
≤14.5.2Update to 14.5.3
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.9Update to 7.3.12
- Medium5.3Unauthenticated Information Exposure
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.1.0Update to 4.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.5Update to 5.7.6
- Medium4.3Missing Authorization
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
≤2.1.3Update to 2.1.4
- High8.8Cross-Site Request Forgery via 'user_email' Parameter
Memberpress
≤1.14.1Update to 1.14.2
- High7.21.5.9 - Unauthenticated Stored Cross-Site Scripting
Community Events
1.4.9 – 1.5.9Update to 1.6.0
- Medium5.3Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- High8.8Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.276Update to 1.0.277
- High8.8Authenticated (Subscriber+) Account Takeover
OTP Login With Phone Number, OTP Verification
≤1.8.78Update to 1.8.79
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.1Update to 4.0.2
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Photo Engine (Media Organizer & Lightroom)
≤6.5.0Update to 6.6.0
- Critical9.8Unauthenticated Arbitrary File Upload
Chat AI with Dispatcher
≤2.3Update to 2.4
- Medium5.3Unauthenticated Information Exposure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.196Update to 2.8.197
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Automated Import Products to Cart
≤1.0.3Update to 1.0.4
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
LogixFast Auth
≤1.0.3Update to 1.0.4
- Medium5.3Unauthenticated Payment Bypass
MembershipWorks – Membership, Events & Directory
≤6.16Update to 6.17
- Medium4.3Authenticated (Subscriber+) Two-Factor Authentication Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.4.0Update to 5.5.0
- Medium4.3Cross-Site Request Forgery
WP Photo Album Plus
≤9.3.04.3Update to 9.3.04.004
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Enable SVG, WebP, and ICO Upload
≤1.1.5Update to 1.1.6
- Medium6.41.1.5 - Authenticated (Author+) Stored Cross-Site Scripting
Enable SVG, WebP, and ICO Upload
1.1.3 – 1.1.5Update to 1.1.6
- Medium5.3Missing Authorization
Hide Price Until Login
≤1.1.1Update to 1.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
≤2.8.1Update to 2.8.2
- Medium5.3Missing Authorization
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.1.0Update to 4.2.0
- High8.1Unauthenticated PHP Object Injection
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.4Update to 6.0.0.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
LetterPress – Email Marketing, SMTP, Newsletter & Multi-Brand Subscriber Manager
≤2.3.0Update to 2.4.0