VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

37,978 total · sorted by risk
  • CVE-2024-32709CriApr 24, 2024
    WordPress
    Wp Recall
    risk 0.61cvss 9.3epss 0.06

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.

  • CVE-2024-32128CriApr 15, 2024
    WordPress
    Realtyna Organic IDX
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4.

  • CVE-2024-30502CriMar 29, 2024
    Wptravelengine
    Wp Travel Engine
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

  • CVE-2024-30498CriMar 29, 2024
    Crmperks
    CRM Perks Forms
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.

  • CVE-2024-30490CriMar 29, 2024
    Metagauss
    Profilegrid
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

  • CVE-2023-28787CriMar 26, 2024
    Expresstech
    Quiz And Survey Master
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.

  • CVE-2023-6567CriJan 11, 2024
    WordPress
    Learnpress
    risk 0.61cvss 9.8epss 0.51

    The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. …

  • CVE-2023-50839CriDec 28, 2023
    Joomsky
    Js Help Desk
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.

  • CVE-2023-49776CriDec 20, 2023
    Hakan Demiray
    Sayfa Sayac
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.

  • CVE-2023-32590CriDec 20, 2023
    Subscribe To Category Project
    Subscribe To Category
    risk 0.61cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.

  • CVE-2023-49750CriDec 19, 2023
    Spoonthemes
    Couponis
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Submitting Coupons WordPress Theme.This issue affects Couponis - Affiliate & Submitting Coupons WordPress Theme: from n/a before 2.2.

  • CVE-2023-48738CriDec 19, 2023
    Portotheme
    Functionality
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1.

  • CVE-2023-6360HigNov 30, 2023
    WordPress
    My Calendar
    risk 0.61cvss 8.6epss 0.63

    The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.

  • CVE-2022-47615CriJan 26, 2023
    WordPress
    Learnpress
    risk 0.61cvss 9.3epss 0.05

    Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

  • CVE-2022-4101CriJan 16, 2023
    WordPress
    Images Optimize and Upload CF7
    risk 0.61cvss 9.1epss 0.29

    The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

  • CVE-2022-3142HigSep 19, 2022
    WordPress
    NEX-Forms
    risk 0.61cvss 8.8epss 0.15

    The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however…

  • CVE-2022-3141HigSep 19, 2022
    WordPress
    Translate Multilingual Sites
    risk 0.61cvss 8.8epss 0.05

    The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload…

  • CVE-2022-33965CriJul 25, 2022
    WordPress
    WP Visitor Statistics
    risk 0.61cvss 9.3epss 0.04

    Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

  • CVE-2022-1103HigMay 16, 2022
    WordPress
    Advanced Uploader
    risk 0.61cvss 8.8epss 0.16

    The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE

  • CVE-2022-0591CriMar 21, 2022
    WordPress
    Formcraft
    risk 0.61cvss 9.1epss 0.20

    The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

  • CVE-2021-43409CriNov 19, 2021
    WordPress
    Wpo365 Login
    risk 0.61cvss 9.3epss 0.01

    The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and…

  • CVE-2021-24581HigAug 30, 2021
    WordPress
    Blue Admin
    risk 0.61cvss 8.8epss 0.04

    The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the…

  • CVE-2021-24307HigMay 24, 2021
    Aioseo
    All In One Seo
    risk 0.61cvss 8.8epss 0.53

    The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's…

  • CVE-2013-2009HigFeb 7, 2020
    WordPress
    WP Super Cache Plugin
    risk 0.61cvss 8.8epss 0.13

    WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution

  • CVE-2012-6649CriJan 23, 2020
    WordPress
    WP GPX Maps Plugin
    risk 0.61cvss 9.8epss 0.16

    WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.

  • CVE-2020-7048CriJan 16, 2020
    WordPress
    WP Database Reset
    risk 0.61cvss 9.1epss 0.23

    The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a…

  • CVE-2019-9978MedKEVMar 24, 2019
    WordPress
    Social Warfare
    risk 0.61cvss 6.1epss 0.73

    The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

  • CVE-2014-9260HigAug 7, 2017
    WordPress
    Download Manager
    risk 0.61cvss 8.8epss 0.11

    The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.

  • CVE-2017-9603HigJun 13, 2017
    WordPress
    WP Jobs
    risk 0.61cvss 8.8epss 0.04

    SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.

  • CVE-2026-81800CriSep 10, 2026
    WordPress
    Verified Reviews
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

  • CVE-2026-84768CriSep 3, 2026
    WordPress
    VikAppointments Services Booking Calendar
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

  • CVE-2026-81286CriSep 2, 2026
    WordPress
    WCFM Marketplace
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

  • CVE-2026-81763CriAug 31, 2026
    WordPress
    Throws Spam Away
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

  • CVE-2026-81756CriAug 31, 2026
    WordPress
    Smart Marketing SMS and Newsletters Forms
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

  • CVE-2026-81293CriAug 31, 2026
    WordPress
    Wp Data Access
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

  • CVE-2026-77012CriAug 29, 2026
    WordPress
    risk 0.60cvss 9.3epss 0.00

    The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated…

  • CVE-2026-78288CriAug 27, 2026
    WordPress
    Beautiful Taxonomy Filters
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.

  • CVE-2026-78260CriAug 27, 2026
    WordPress
    Epayco
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

  • CVE-2026-32479CriAug 27, 2026
    WordPress
    Visitor Traffic Real Time Statistics Pro
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

  • CVE-2026-32555CriAug 24, 2026
    WordPress
    Boost
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Boost <= 2.0.4 versions.

  • CVE-2026-32554CriAug 24, 2026
    WordPress
    Product Filter by WooBeWoo
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.

  • CVE-2026-32551CriAug 24, 2026
    WordPress
    Woo Essential
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.

  • CVE-2026-68566CriAug 20, 2026
    WordPress
    Bookingpress Appointment Booking
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.

  • CVE-2026-66680CriAug 20, 2026
    WordPress
    Locatoraid Store Locator
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

  • CVE-2026-66649CriAug 20, 2026
    WordPress
    Directory Pro
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

  • CVE-2026-66609CriAug 20, 2026
    WordPress
    Thegem
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

  • CVE-2026-66593CriAug 20, 2026
    WordPress
    Security & Malware scan by CleanTalk
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.

  • CVE-2026-66592CriAug 20, 2026
    WordPress
    Rtmedia
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.

  • CVE-2025-15688CriAug 20, 2026
    WordPress
    Capella
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

  • CVE-2026-73391CriAug 19, 2026
    WordPress
    Total Donations
    risk 0.60cvss 9.3epss 0.00

    Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

Page 40 of 760