CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6926 – Viral Signup <= 2.1 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2024-6926
07 Aug 2024 — The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection The Viral Signup – limited opt-in with viral refferal sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. ... The... • https://wpscan.com/vulnerability/9ce96ce5-fcf0-4d7a-b562-f63ea3418d93 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2024-43160 – WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability
https://notcve.org/view.php?id=CVE-2024-43160
07 Aug 2024 — The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. • https://patchstack.com/database/vulnerability/searchpro/wordpress-berqwp-plugin-1-7-6-unauthenticated-arbitrary-file-upload-vulnerability? • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2024-5057 – WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-5057
01 Aug 2024 — The Easy Digital Downloads plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-sql-injection-vulnerability? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39653 – WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-39653
01 Aug 2024 — The VikRentCar plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://patchstack.com/database/vulnerability/vikrentcar/wordpress-vikrentcar-car-rental-management-system-plugin-1-4-0-sql-injection-vulnerability? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6847 – SmartSearch WP <= 2.4.4 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2024-6847
29 Jul 2024 — The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot. The Chatbot with ChatGPT WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL... • https://wpscan.com/vulnerability/baa860bb-3b7d-438a-ad54-92bf8e21e851 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38795 – WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-38795
22 Jul 2024 — The ListingPro plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://patchstack.com/database/vulnerability/listingpro-plugin/wordpress-listingpro-plugin-2-9-3-unauthenticated-sql-injection-vulnerability? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39622 – WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-39622
22 Jul 2024 — The ListingPro theme for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://patchstack.com/database/vulnerability/listingpro/wordpress-listingpro-theme-2-9-3-unauthenticated-sql-injection-vulnerability? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38773 – WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-38773
19 Jul 2024 — The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to SQL Injection via the 'form_id' parameter in versions up to, and including, 7.5.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://patchstack.com/database/vulnerability/formlift/wordpress-formlift-plugin-7-5-17-unauthenticated-blind-sql-injection-vulnerability? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37933 – WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-37933
09 Jul 2024 — The Woocommerce OpenPos plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://patchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sql-injection-vulnerability? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5765 – WpStickyBar <= 2.1.0 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2024-5765
09 Jul 2024 — The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection The WpStickyBar – Sticky Bar, Sticky Header plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter of the 'stickybar_display' AJAX action in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of suf... • https://wpscan.com/vulnerability/0b73f84c-611e-4681-b362-35e721478ba4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •