VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 92)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 92)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization
WebSamurai≤1.0.7No patch available
CVE-2026-39439—
Medium4.3Missing Authorization
Airano MCP Bridge≤2.11.0No patch available
CVE-2026-32585—
Medium5.3Unauthenticated Information Exposure
Smart One Click Setup – Complete Demo Import & Export≤1.4.3No patch available
CVE-2026-32584—
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.7Update to 4.4.8
CVE-2026-92538—
Medium6.1Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.4Update to 4.17.5
CVE-2026-92551—
High8.8Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.4Update to 4.17.5
CVE-2026-92536—
Medium6.1Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
EWWW Image Optimizer≤8.7.7Update to 8.8.0
CVE-2026-92826—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
EmbedPress≤4.6.6Update to 4.6.7
CVE-2026-92727—
Medium6.5Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
Beaver Builder Page Builder – Drag and Drop Website Builder≤2.11.0.5Update to 2.11.0.6
CVE-2026-95865—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot≤3.5.3Update to 3.5.4
CVE-2026-94378—
Medium6.1Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Ivory Search – WordPress Search Plugin≤5.5.18Update to 5.5.19
CVE-2026-92243—
Medium6.5Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot≤3.5.3Update to 3.5.4
CVE-2026-94539—
High7.5Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.13.1Update to 2.14.0
CVE-2026-93428—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress≤3.2.19Update to 3.2.20
CVE-2026-100180—
High7.2Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.13.1Update to 2.14.0
CVE-2026-96270—
Medium5.3Unauthenticated Insecure Direct Object Reference
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.9Update to 4.4.9.1
CVE-2026-104403—
Medium4.3Authenticated (Subscriber+) Information Exposure
Advanced Ads – Ad Manager & AdSense≤2.0.26Update to 2.0.27
CVE-2026-94180—
Medium5.3Unauthenticated Information Exposure
Download Manager≤3.3.70Update to 3.3.71
CVE-2026-94405—
High7.5Unauthenticated SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps≤5.5.82Update to 5.5.83
CVE-2026-95605—
Medium5.3Unauthenticated Information Exposure
Cost Calculator Builder≤4.0.17Update to 4.0.18
CVE-2026-97307—
Medium6.5Authenticated (Subscriber+) SQL Injection
WPLMS Learning Management System for WordPress, WordPress LMS≤4.973Update to 4.974
CVE-2026-95607—
Medium6.1Reflected Cross-Site Scripting
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard≤1.4.3.2Update to 1.4.4
CVE-2026-95608—
Medium6.1Reflected Cross-Site Scripting
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI≤3.6.1Update to 3.6.2
CVE-2026-94670—
Medium6.1Reflected Cross-Site Scripting
Disable and Remove Google Fonts | GDPR & DSGVO friendly≤2.0.2Update to 2.0.3
CVE-2026-95595—
High7.5Unauthenticated SQL Injection
UpSolution Core≤9.3Update to 9.3.1
CVE-2026-95610—
Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia≤2.4.10Update to 2.4.11
CVE-2026-96461—
Medium4.3Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.3Update to 4.17.4
CVE-2026-96337—
Medium5.3Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.3Update to 4.17.4
CVE-2026-96518—
Medium6.1Reflected Cross-Site Scripting
FiboSearch – Ajax Search for WooCommerce≤1.34.1Update to 1.34.2
CVE-2026-96553—
High7.3Unauthenticated Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.13.1Update to 2.14.0
CVE-2026-96539—

Search VulnCrest Radar

Jump to

Are you sure?