Known vulnerabilities in Injection Guard

This plugin blocks all unauthorized and irrelevant requests through query strings and provides extended session tracking and capability audit.

6Reported vulnerabilities

7.2Highest CVSS score

1.3.1Latest version

1,000+Active installs

What to do now

Update Injection Guard to 1.3.0 or later. 6 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 2, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2025-8046	Medium 6.1	0.2%	Before 1.2.8	`1.2.8`	August 14, 2025
CVE-2026-3368	High 7.2	0.3%	0 to 1.2.9 (inclusive)	`1.3.0`	March 21, 2026
WF-a9c41797-b256-47de-a783-18df36dd2234	Medium 5.3	—	1.2.1 and earlier	`1.2.2`	May 10, 2023
WF-4a5c4bef-f871-4e6b-9b6e-85079f1233a2	Medium 4.3	—	1.2.1 and earlier	`1.2.2`	May 11, 2023
CVE-2023-32574	Medium 4.3	0.4%	1.2.1 and earlier	`1.2.2`	May 11, 2023
WF-1a6bc58f-9cf3-4d3f-a10e-0ccde0b890a3	Medium 4.3	—	1.2.1 and earlier	`1.2.2`	May 10, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.