Wpdataaccess
Wpdataaccess WP Data Access: vulnerabilities and CVEs
Wpdataaccess WP Data Access has 14 published vulnerabilities, 9 of them in the last 12 months. 3 are rated critical and 0 are listed by CISA as actively exploited.
CVEs14
Last 12 months9
Critical3
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-93621 | High (8.2) | 0.35% | — | Sep 30, 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
| CVE-2026-81293 | Critical (9.3) | 0.40% | — | Aug 31, 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. |
| CVE-2026-3235 | Medium (5.3) | 0.40% | — | Aug 26, 2026 | The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled… |
| CVE-2026-66595 | Medium (5.9) | 0.32% | — | Aug 20, 2026 | Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions. |
| CVE-2026-73344 | Medium (5.9) | 0.24% | — | Aug 13, 2026 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
| CVE-2026-18032 | High (7.5) | 0.43% | — | Aug 9, 2026 | The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing… |
| CVE-2026-66663 | High (7.1) | 0.25% | — | Aug 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
| CVE-2026-42665 | Critical (9.3) | 0.40% | — | Jun 15, 2026 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. |
| CVE-2026-0557 | Medium (6.4) | 0.23% | — | Feb 14, 2026 | The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app' shortcode in all versions up to, and including, 5.5.63 due to insufficient input sanitization and output… |
| CVE-2025-39582 | Medium (6.5) | 0.32% | — | Apr 16, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access:… |
| CVE-2024-12428 | High (7.5) | 0.48% | — | Dec 25, 2024 | The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'order[user_login][dir]' parameter in all versions up to, and including, 5.5.22 due to… |
| CVE-2024-43295 | Medium (4.3) | 0.18% | — | Aug 26, 2024 | Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7. |
| CVE-2023-1874 | High (8.8) | 2.7% | — | Apr 12, 2023 | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it… |
| CVE-2021-24866 | Critical (9.8) | 1.6% | — | Dec 6, 2021 | The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.