Wpdataaccess
Wpdataaccess WP Data Access: vulnerabilidades y CVE
Wpdataaccess WP Data Access tiene 14 vulnerabilidades publicadas, 9 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses9
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-93621 | Alta (8.2) | 0.35% | — | 30 sept 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
| CVE-2026-81293 | Crítica (9.3) | 0.40% | — | 31 ago 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. |
| CVE-2026-3235 | Media (5.3) | 0.40% | — | 26 ago 2026 | The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled… |
| CVE-2026-66595 | Media (5.9) | 0.32% | — | 20 ago 2026 | Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions. |
| CVE-2026-73344 | Media (5.9) | 0.24% | — | 13 ago 2026 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
| CVE-2026-18032 | Alta (7.5) | 0.43% | — | 9 ago 2026 | The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing… |
| CVE-2026-66663 | Alta (7.1) | 0.25% | — | 6 ago 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
| CVE-2026-42665 | Crítica (9.3) | 0.40% | — | 15 jun 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. |
| CVE-2026-0557 | Media (6.4) | 0.23% | — | 14 feb 2026 | The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app' shortcode in all versions up to, and including, 5.5.63 due to insufficient input sanitization and output… |
| CVE-2025-39582 | Media (6.5) | 0.32% | — | 16 abr 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access:… |
| CVE-2024-12428 | Alta (7.5) | 0.48% | — | 25 dic 2024 | The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'order[user_login][dir]' parameter in all versions up to, and including, 5.5.22 due to… |
| CVE-2024-43295 | Media (4.3) | 0.18% | — | 26 ago 2024 | Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7. |
| CVE-2023-1874 | Alta (8.8) | 2.7% | — | 12 abr 2023 | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it… |
| CVE-2021-24866 | Crítica (9.8) | 1.6% | — | 6 dic 2021 | The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.