Is my WordPress plugin safe?

• Jan 24, 2025Bug Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24728 · affects up to 2.1.4 · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4.

  NVD recordpatchstack.com

• Jul 19, 2024Bug Library: Does not sanitise and escape some of its settingsCVE-2024-5604 · fixed in 2.1.2 · reported by WPScanMedium 5.9

  The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  NVD recordwpscan.comwpscan.com

• Jul 13, 2024Bug Library: Does not check the file type on user-submitted bug reportsCVE-2024-5450 · fixed in 2.1.1 · reported by WPScanCritical 9.1

  The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files

  NVD recordwpscan.comwpscan.com

• Sep 10, 2021Bug Library: Reflected Cross-Site ScriptingCVE-2021-38355 · affects up to 2.0.3 · reported by WordfenceMedium 6.1

  The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.

  NVD recordplugins.trac.wordpress.orgwordfence.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.