Query Wrangler
by WordPress
Source repositories
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-73992 | Cri | 0.64 | 9.9 | 0.01 | Aug 20, 2026 | Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. | ||
| CVE-2026-14498 | Hig | 0.57 | 8.8 | 0.01 | Aug 16, 2026 | The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with… | ||
| CVE-2023-30779 | Hig | 0.46 | 7.1 | 0.00 | Aug 16, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions. | ||
| CVE-2025-31779 | Med | 0.35 | 5.4 | 0.00 | Apr 1, 2025 | Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through <= 1.5.54. | ||
| CVE-2026-65491 | Med | 0.00 | 4.3 | 0.00 | Jul 23, 2026 | Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions. |
- risk 0.64cvss 9.9epss 0.01
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
- risk 0.57cvss 8.8epss 0.01
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with…
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions.
- risk 0.35cvss 5.4epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through <= 1.5.54.
- risk 0.00cvss 4.3epss 0.00
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.