Wp Data Access Vulnerabilities

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers...

CVSS:

5.3

Affected:

up to 5.5.68

Fixed in:

5.5.69

Disclosed:

Aug 25, 2026

CVE-2026-3235 on NVD →

The WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.5.80. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized a...

CVSS:

5.3

Affected:

up to 5.5.80

Fixed in:

5.5.81

Disclosed:

Aug 19, 2026

CVE-2026-66595 on NVD →

The WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.79 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acces...

CVSS:

6.4

Affected:

up to 5.5.79

Fixed in:

5.5.80

Disclosed:

Aug 12, 2026

CVE-2026-73344 on NVD →

The WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.79 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVSS:

7.2

Affected:

up to 5.5.79

Fixed in:

5.5.80

Disclosed:

Aug 5, 2026

CVE-2026-66663 on NVD →

The Data Access plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.5.78. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 5.5.78

Fixed in:

5.5.79

Disclosed:

Aug 3, 2026

CVE-2026-18032 on NVD →

The WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.5.70 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVSS:

7.5

Affected:

up to 5.5.70

Fixed in:

5.5.71

Disclosed:

May 9, 2026

CVE-2026-42665 on NVD →

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 5.5.31

Fixed in:

5.5.32

Disclosed:

Apr 30, 2026

CVE-2024-13362 on NVD →

The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app' shortcode in all versions up to, and including, 5.5.63 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib...

CVSS:

6.4

Affected:

up to 5.5.63

Fixed in:

5.5.64

Disclosed:

Feb 13, 2026

CVE-2026-0557 on NVD →

The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 5.5.36

Fixed in:

5.5.37

Disclosed:

Apr 16, 2025

CVE-2025-39582 on NVD →

The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'order[user_login][dir]' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL qu...

CVSS:

7.5

Affected:

up to 5.5.22

Fixed in:

5.5.23

Disclosed:

Dec 24, 2024

CVE-2024-12428 on NVD →

The WP Data Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.5.7. This is due to missing or incorrect nonce validation on the backup_page() function. This makes it possible for unauthenticated attackers to trigger backups via a forged request granted they can t...

CVSS:

4.3

Affected:

up to 5.5.7

Fixed in:

5.5.9

Disclosed:

Aug 16, 2024

CVE-2024-43295 on NVD →

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their u...

CVSS:

7.5

Affected:

up to 5.3.7

Fixed in:

5.3.8

Disclosed:

Apr 6, 2023

CVE-2023-1874 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 5.1.4

Fixed in:

5.1.4

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion

CVSS:

7.2

Affected:

up to 4.3.1

Fixed in:

5.0.0

Disclosed:

Nov 8, 2021

CVE-2021-24866 on NVD →