Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?CharitableActive Products Tables for WooCommercewpdatatablesninja-tablesParticipants DatabaseTablesomeDatabase for Contact Form 7, WPforms, Elementor formsWP Table Builder
Plugin · participants-database
Participants Database
17 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 23, 2026Participants Database: Deserialization of Untrusted DataCVE-2026-112862 · affects up to 2.7.8.5 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Oct 23, 2026Participants Database: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112860 · affects up to 2.7.8.5 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Oct 20, 2026Participants Database: Authorization Bypass Through User-Controlled KeyCVE-2026-112861 · affects up to 2.7.8.5 · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
Aug 13, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.CVE-2026-28189 · affects up to 2.7.8.4 · reported by PatchstackHigh 7.4
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
Aug 1, 2026Participants Database: Does not properly sanitize and escape a user-supplied parameter before using it in a SQL queryCVE-2026-13596 · fixed in 2.7.8.4 · reported by WPScanCritical 9.1
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Jul 24, 2026Participants Database: Sensitive Information ExposureCVE-2026-11354 · affects up to 2.7.8.3 · reported by WordfenceMedium 5.3
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.CVE-2026-59555 · affects up to 2.7.8.3 · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
Jul 23, 2026Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.CVE-2026-59525 · affects up to 2.7.8.3 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
Jul 23, 2026Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.CVE-2026-27423 · affects up to 2.7.8.4 · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
Sep 22, 2025Participants Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58008 · affects up to 2.7.6.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.
Aug 13, 2024Participants Database: Deserialization of Untrusted DataCVE-2024-43141 · affects up to 2.5.9.2 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
Dec 18, 2023Participants Database: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-48751 · affects up to 2.5.5 · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.CVE-2023-31235 · fixed in 2.5.0 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.CVE-2022-47612 · fixed in 2.4.6 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.
Feb 11, 2020participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the aCVE-2020-8596 · affects up to 1.9.5.5 · reported by MITREHigh 7.5
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Sep 4, 2017The Participants Database plugin before 1.7.5.10 for WordPress has XSS.CVE-2017-14126 · fixed in 1.7.5.10 · reported by MITREMedium 6.1
The Participants Database plugin before 1.7.5.10 for WordPress has XSS.
Jun 4, 2014SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitraryCVE-2014-3961 · fixed in 1.5.4.9 · reported by MITREHigh 7.5
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.