CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 68)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Arbitrary File Read via 'f' Parameter
Music Store – WordPress eCommerce
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.2.1Update to 10.3.0
- High8.8Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.3Update to 5.7.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- High8.1Unauthenticated Privilege Escalation to Support User Identity Confusion
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- High8.8Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Low3.1Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Low3.1Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- High8.1Unauthenticated Local File Inclusion via 'design_type' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.187Update to 2.8.188
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
FV Player 8
≤8.1.7Update to 8.1.8
- High8.8Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
FooSales – Point of Sale (POS) for WooCommerce
≤1.43.0Update to 1.43.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
Church Admin
≤5.1.2Update to 5.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
Getwid – Gutenberg Blocks
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
Table Field Add-on for ACF and SCF
≤1.3.35Update to 1.3.40
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
≤2.7.13Update to 2.7.14
- Medium5.3Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
Booking Calendar
≤11.4.3Update to 11.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
Graphene
≤2.9.4Update to 2.9.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
Real Estate Manager – Property Listing and Agent Management
≤7.3Update to 7.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
Brizy – Page Builder
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.12.03Update to 1.12.04
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.4Update to 7.9.5
- High7.2Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.9Update to 3.6.9.1
- Medium6.1Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Download Manager
≤3.3.57Update to 3.3.58
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Download Manager
≤3.3.58Update to 3.3.59
- Medium5.3Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
Simply Schedule Appointments
≤1.6.11.11Update to 1.6.12.0