34 matches found
WP Custom Cursors < 3.2 - Admin+ SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin. 1. Add a new "WP Custom Cursor". 2. Return to the "WP Custom Cursors" page and click edit Cursor. 3.The WP Custom Cursors...
CVE-2015-10100 Dynamic Widgets Plugin dynwid_class.php sql injection
A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwidclass.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to versio...
PT-2023-14760 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions prior to 4.1.7.3.2 Description: The issue is related to a SQL Injection vulnerability. Recommendations: For LearnPress – WordPress LMS Plugin versions prior to 4.1.7.3.2, update to a version newer th...
CVE-2022-0592
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users...
CVE-2025-47608
creationtimestamp| type| source ---|---|--- 2021-02-04 17:02:47+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wpabandonedcartsqli.rb 2025-06-09 18:11:10+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17726 2025-10-...
CVE-2015-9395
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action...
CVE-2015-9334
The email-newsletter plugin through 20.15 for WordPress has SQL injection...
WpJobBoard <= 4.4.4 - Multiple SQL Injections
The wpjobboard WordPress plugin was affected by a Multiple SQL Injections security vulnerability...
CVE-2017-14848
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...
EUVD-2017-6220
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...
Wordpress 0.6/0.7 Blog.Header.PHP SQL Injection Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/8756/info Wordpress has been reported prone to multiple SQL injection vulnerabilities. The issues have been reported to exist in the blog.header.php script. A lack of sufficient sanitization performed on 'cat' and 'orderb...
CVE-2007-4894
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user MU before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the posttype parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters...
wpSQL.txt
Version Afected: v2.0.5 - v2.0.2 For Version v2.0.2 index.php?paged=-25633&header.php?=-id For Version v2.0.5 index.php?paged=/archive/-1-5-2-Create%20Table PATH DISCLOSOURE /wp-settings.php /wp-admin/admin-footer.php /wp-admin/admin-functions.php /wp-admin/edit-form.php...
