Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · query-wrangler
query-wrangler
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 20, 2026Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.CVE-2026-73992 · affects up to 1.5.57 · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
Aug 16, 2026Query Wrangler: Remote Code ExecutionCVE-2026-14498 · affects up to 1.5.57 · reported by WordfenceHigh 8.8
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.CVE-2026-65491 · affects up to 1.5.57 · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
Apr 1, 2025Query Wrangler: Cross-Site Request Forgery (CSRF)CVE-2025-31779 · affects up to 1.5.54 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through <= 1.5.54.
Aug 16, 2023Unauth.CVE-2023-30779 · affects up to 1.5.51 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.