Injection Guard Vulnerabilities

The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1.2.9. This is due to insufficient input sanitization in the sanitize_ig_data() function which only sanitizes array values but not array keys, combined with missi...

CVSS:

7.2

Affected:

up to 1.2.9

Fixed in:

1.3.0

Disclosed:

Mar 20, 2026

CVE-2026-3368 on NVD →

The Injection Guard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['REQUEST_URI'] parameter in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVSS:

6.1

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Jul 24, 2025

CVE-2025-8046 on NVD →

[en] Missing Authorization vulnerability in Fahad Mahmood Injection Guard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Injection Guard: from n/a through 1.2.1.

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Dec 13, 2024

CVE-2023-32574 on NVD →

The Injection Guard plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ig_update functions in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to make changes to IP block- and allowlists via a forged request granted they can tri...

CVSS:

4.3

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

May 11, 2023

The Injection Guard plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ig_update and ig_update_bulk_backlist functions in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers , with subscriber-level access and above, to make ch...

CVSS:

4.3

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

May 11, 2023

CVE-2023-32574 on NVD →

The Injection Guard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ig_update function in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's whiteli...

CVSS:

5.3

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

May 10, 2023

The Injection Guard plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the ig_update function. This makes it possible for unauthenticated attackers to update the plugin's whitelist via a forged request granted...

CVSS:

4.3

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

May 10, 2023

The Injection Guard plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the ig_update function. This makes it possible for unauthenticated attackers to update the plugin's whitelist via a forged request granted...

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

May 10, 2023

The Injection Guard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ig_update function in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's whiteli...

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

May 10, 2023

Affected:

up to 1.2.8

Fixed in:

1.2.8

CVE-2025-8046 on NVD →