CVE-2025-6462: Improper Neutralization of Input During Web Page Generation

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2025-30788: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through = 5.25.08...

CVE-2025-30787: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through = 5.25.08...

PT-2025-12780

Name of the Vulnerable Software and Affected Versions EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress versions 4.11.13 through 5.25.08 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ELISQLREPORTS menu function...

CVE-2025-2319: Cross-Site Request Forgery (CSRF)

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTSmenu' function. This makes it possible for unauthenticated attackers to...

CVE-2025-26887: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through = 5.21.35...