EZ SQL Reports Shortcode Widget and DB Backup vulnerabilities

2 known vulnerabilities in EZ SQL Reports Shortcode Widget and DB Backup from Scheeeli. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  EZ SQL Reports Shortcode Widget and DB Backup: Improper Neutralization of Input During Web Page Generation

  CVE-2026-120688Nov 13, 2026Scheeeli

  The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions

• 8.8 High severity

  EZ SQL Reports Shortcode Widget and DB Backup: Cross-Site Request Forgery

  CVE-2025-2319Mar 25, 2025Scheeeli

  The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTS_menu' function. This makes it possible