CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 46)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.0.2 – 2.12.2Update to 2.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
<12.6.8Update to 12.6.8
- Medium5.3Missing Authorization
Infility Global
≤2.16.24Update to 2.16.25
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Ultimate Review
≤2.4.4Update to 2.4.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
FluentCart – Online Store Builder & eCommerce Checkout
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
DiviGear Carousel
≤5.2.0Update to 5.2.2
- High7.5Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
EventON - Subscriber
≤1.4.5No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Mang Board
≤2.4.4Update to 2.4.5
- Medium5.3Missing Authorization
BjornTech Swish for WooCommerce
≤3.7.8Update to 3.7.9
- Medium6.1Reflected Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Missing Authorization
Surfer – WordPress Plugin
≤1.8.0.744Update to 1.8.1.759
- High7.5Authenticated (Contributor+) Local File Inclusion
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤34.0.1Update to 34.0.2
- Medium6.1Reflected Cross-Site Scripting
ThemeHunk Customizer
≤2.8.7Update to 2.8.8
- Medium6.1Reflected Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.14Update to 7.5.15
- High7.5Unauthenticated SQL Injection
Ajax Search Lite – Live Search & Filter
≤4.14.6Update to 4.14.7
- Medium5.3Missing Authorization
YITH WooCommerce Product Bundles
≤2.29.0Update to 2.30.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Tickets and Registration
≤5.30.1Update to 5.30.2
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.15Update to 6.2.16
- Medium4.3Missing Authorization
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses
≤2.11.0Update to 2.12.0
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.4Update to 2.9.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress
≤1.32.57Update to 1.32.58
- Medium5.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.5Update to 2.3.6
- Medium5.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.7Update to 7.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Wishlist
≤4.18.1Update to 4.19.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory
≤2.8.2Update to 2.8.3
- High7.5Authenticated (Contributor+) PHP Object Injection
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
≤1.9.2Update to 1.9.3