CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 63)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.4Update to 4.8.5
- Medium4.9Authenticated (Editor+) SQL Injection
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.1.1Update to 1.1.2
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.4Update to 1.5.5
- Medium5.3Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
Spin Wheel – Interactive spinning wheel that offers coupons
≤2.2.0Update to 2.2.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Visual Form Builder
≤3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium6.1Reflected Cross-Site Scripting
XStore
<9.7.9Update to 9.7.9
- Medium4.3Missing Authorization
Easy HTTPS Redirection (SSL)
≤2.0.1Update to 2.0.2
- High7.5Unauthenticated SQL Injection
Mobile builder
≤1.4.2No patch available
- Medium5.33.4.1 - Unauthenticated Arbitrary Order Status Manipulation
Cardinity Payment Gateway for WooCommerce
3.2.6 – 3.4.1Update to 3.4.2
- Medium5.3Unauthenticated Payment Bypass
Coinbase Commerce Payment Gateway for WooCommerce
≤1.4.1No patch available
- Medium5.3Missing Authorization
eaSYNC Booking – Hotels, Restaurants & Car Rentals
≤1.3.30Update to 1.3.31
- Medium4.3Cross-Site Request Forgery
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Unauthenticated Arbitrary HTML Attribute Injection
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- High7.2Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.10.6Update to 2.10.7
- Medium4.9Authenticated (Editor+) SQL Injection via 'counterid' Parameter
Animated Number Counters
≤3.0Update to 3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium4.3Missing Authorization
WP-Members Membership Plugin
≤3.5.7Update to 3.5.8
- Medium5.3Missing Authorization
Skydropx
≤2.1.4Update to 2.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.27Update to 4.6.28
- Medium6.1Reflected Cross-Site Scripting
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- Medium6.1Reflected Cross-Site Scripting
SimplyRETS Real Estate IDX
≤3.2.9Update to 3.3.0
- Critical9.8Unauthenticated Remote Code Execution
MDTF – Meta Data and Taxonomies Filter
≤1.3.9Update to 1.4.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.17Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.10.0Update to 1.11.0
- Medium5.3Missing Authorization
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111