VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-89Vulnerability type

WordPress SQL Injection vulnerabilities (page 97)

Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.

How to prevent sql injection in WordPress plugins
Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress SQL Injection vulnerabilities (page 97)
SeverityVulnerabilityCVEInstallsPublished
Medium5.34.3.0 - Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor2.2.1 – 4.3.0Update to 4.3.1
CVE-2026-86834—
High7.52.0.20 - Unauthenticated SQL Injection
Unlimited Elements for Elementor1.5.139 – 2.0.20Update to 2.0.21
CVE-2026-85568—
Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export≤9.1Update to 9.2
CVE-2026-80518—
Medium4.9Authenticated (Editor+) Arbitrary File Read
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO≤4.2.2Update to 4.2.3
CVE-2026-103293—
High7.1Authenticated (Admin+) Arbitrary Directory Deletion
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101889—
Medium5.3Unauthenticated Persistent Denial of Service
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101160—
High7.2Unauthenticated Stored Cross-Site Scripting
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101159—
Medium5.3Missing Authorization
Mailchimp for WooCommerce≤6.2Update to 6.3
CVE-2026-92437—
Medium6.4Authenticated (Translator+) Stored Cross-Site Scripting
Loco Translate≤2.8.8Update to 2.8.9
CVE-2026-94239—
High7.5Unauthenticated SQL Injection
SaveTo Wishlist Lite – WooCommerce Wishlist≤1.1.4Update to 1.1.5
CVE-2026-89236—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kubio AI Page Builder≤2.9.2Update to 2.9.3
CVE-2026-88782—
Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Emails
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤4.3.0Update to 4.3.1
CVE-2026-86833—
High7.2Authenticated (Admin+) Arbitrary File Write
Unlimited Elements for Elementor≤2.0.20Update to 2.0.21
CVE-2026-85015—
Medium4.49.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export7.17 – 9.1Update to 9.2
CVE-2026-80517—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Horizontal scrolling announcements≤2.6No patch available
CVE-2026-17005—
Medium4.3Unauthenticated Two-Factor Authentication Bypass
WP 2FA – Two-factor authentication for WordPress≤4.0.0Update to 4.1.0
CVE-2026-103514—
High7.3Unauthenticated Captcha Verification Bypass
hCaptcha for WP≤5.3.0Update to 5.4.0
CVE-2026-103347—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101890—
High8.8Authenticated (Admin+) Arbitrary File Upload
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101888—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101162—
High7.2Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.2.1
CVE-2026-92144—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns≤6.4.5Update to 6.4.6
CVE-2026-96256—
Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19
CVE-2026-89427—
High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.2.1
CVE-2026-85235—
High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
PDF Invoices & Packing Slips for WooCommerce≤5.16.1Update to 5.16.2
CVE-2026-92244—
High7.2Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
Business Essentials for Contact Form 7≤1.2.1Update to 1.2.2
CVE-2026-97661—
High8.1Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Super Forms – Drag & Drop Form Builder≤6.3.316Update to 6.3.317
CVE-2026-15983—
Medium4.7Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤5.5.1.3Update to 5.5.1.4
CVE-2026-100184—
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤5.5.1.3Update to 5.5.1.4
CVE-2026-100179—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
bbp style pack≤6.4.8Update to 6.4.9
CVE-2026-101925—

Search VulnCrest Radar

Jump to

Are you sure?