WordPress Plugin Vulnerabilities

Buddyforms < 2.2.8 - SQL Injection

Description

The Contact – Registration – Post Form Builder & FrontEnd Editor BuddyForms – Making WordPress Forms A Breeze WordPress plugin was affected by a SQL Injection security vulnerability.

Affects Plugins

Plugin icon
buddyforms
Fixed in 2.2.8

References

CVE
CVE-2018-21003

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
9.8 (critical)

Miscellaneous

Verified
No
WPVDB ID
d77c6136-f2c2-435d-ad72-c905800234a7

Timeline

Publicly Published
2018-11-09 (about 7 years ago)
Added
2019-08-27 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2025-09-08
Title
ZIP Code Based Content Protection < 1.0.1 - Authenticated (Administrator+) SQL Injection
Published
2021-10-07
Title
Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
Published
2025-06-03
Title
MyStyle Custom Product Designer < 3.21.2 - Unauthenticated SQL Injection
Published
2025-01-03
Title
ARPrice < 4.2 - Subscriber+ SQLi
Published
2025-04-22
Title
Frontend Dashboard < 2.2.6 - Unauthenticated SQL Injection