CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 66)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Arbitrary Shortcode Execution
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
Booster Elite for WooCommerce
<8.4.0Update to 8.4.0
- Medium6.1Reflected Cross-Site Scripting
Marin
≤0.1.1Update to 0.1.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤3.0.0Update to 4.0.0
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.19No patch available
- Medium4.37.1 - Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments
6.1 – 7.1Update to 7.2
- Medium4.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤2.2.4Update to 2.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
PeproDev Ultimate Profile Solutions
≤8.2.36Update to 8.2.37
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤6.1.2Update to 6.2.0
- High7.5Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Divi Plus
≤2.4.0Update to 2.4.1
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
≤5.2.12Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.5Update to 3.16.0.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.8.4Update to 5.8.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Avada | Website Builder For WordPress & WooCommerce
≤7.16.1Update to 7.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
Email Marketing for WordPress and WooCommerce – Retainful
≤1.0.10Update to 1.0.11
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
SureDash – Community, Courses & Member Dashboard
≤1.12.1Update to 1.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.124Update to 1.4.125
- High7.5Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
≤5.0.2Update to 5.0.3
- High8.1Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium4.7Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.2.1Update to 2.0.2.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
WP Directory Kit
≤1.5.9Update to 1.6.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Premium Packages – Sell Digital Products Securely
≤7.2.6Update to 7.2.7
- Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
WPCOM Member
≤1.7.27Update to 1.8.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
WP Photo Album Plus
≤9.3.03.002Update to 9.3.03.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.12Update to 4.3.13