CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 65)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Bonbon
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Avventure
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Filmax | Cinema & Movie News Magazine WordPress Theme
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Orpheus
≤1.8No patch available
- High8.1Unauthenticated PHP Object Injection
Nuts
≤1.12No patch available
- High8.1Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Muzicon - Music Festival & Concert WordPress Theme
≤1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Mission
≤1.22No patch available
- High8.1Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Marcell - Personal Blog & Magazine WordPress Theme
≤1.2.14No patch available
- High8.1Unauthenticated PHP Object Injection
Le Truffe
≤1.1.7No patch available
- High8.1Unauthenticated PHP Object Injection
Legal Stone | Lawyers & Attorneys WordPress Theme
≤1.2.11No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Property Listings
≤3.5.25Update to 3.5.26
- High7.2Unauthenticated Stored Cross-Site Scripting
Auction Nudge – Your eBay Listings
≤8.4.0No patch available
- Medium5.3Unauthenticated Race Condition
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8No patch available
- High8.1Unauthenticated PHP Object Injection
Affiliates
≤7.0.1Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.16Update to 3.8.16.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetProductTables
≤1.2.4Update to 1.2.4.1
- Critical9.1Unauthenticated Arbitrary File Deletion
File Upload to Order for WooCommerce
≤1.1.3Update to 1.1.4
- Medium5.3Missing Authorization
WP OAuth Server ( Login with WordPress )
≤6.4.0Update to 6.5.0
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium5.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- High7.2Unauthenticated Stored Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Frontend Dashboard
≤3.0.7Update to 3.0.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP w3all phpBB
≤3.1.0Update to 3.1.2
- Medium5.3Unauthenticated Session Hijacking
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.2Update to 7.3.3
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.22Update to 2.3.23
- High7.5Authenticated (Custom Role+) PHP Object Injection
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar Lite
<7.37.0Update to 7.37.0
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
Mailonix – Email Template Customizer for WooCommerce
≤1.3.4Update to 1.3.5