SheetDB – get your Google Spreadsheet data

SheetDB – get your Google Spreadsheet data has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for SheetDB – get your Google Spreadsheet data has a vendor fix available, so running the current release closes it.

All of these findings were reported by zaim. SheetDB – get your Google Spreadsheet data is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all SheetDB – get your Google Spreadsheet data vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-31873

SheetDB <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
SheetDB – get your Google Spreadsheet data banner
Latestv1.3.7

SheetDB – get your Google Spreadsheet data

sheetdb

Author

sheetdb

4.8(5)
96/100
Last Updated
2026-08-17 (26d ago)
Active Installs
600+
Downloads
22,901
Requires WP
4.0+
Requires PHP
5.4+
Tested up to
WP 7.1
Created
2019-11-13 (7y ago)

The SheetDB wordpress plugin allows you to easily add content from Google Spreadsheet to your wordpress site. To add content, simply add shortcode that looks like this – [sheetdb url=&#34;https://sheetdb.io/api/v1/YOUR_API_ID&#34;][/sheetdb]. Content from within will be rendered as many times as there are rows in the spreadsheet (excluding the first row, which are column names – definition). Each time a new row is rendered, you can refer to any value using the braces notation: {{column_name}} Example spreadsheet: Example spreadsheet document Example code: [sheetdb url=&#034;https://sheetdb.io/api/v1/58f61be4dda40&#034; element=&#034;ul&#034; limit=3 search=&#034;id=*&#034; sort-by=&#034;id&#034; sort-order=&#034;desc&#034; lazy-loading=&#034;true&#034;] {{id}} – {{name}} [/sheetdb] You can use following optional attributes: * limit – The number of rows that should be returned * offset – Row from which it should start (how many rows to skip) * sheet – If you want to use a different sheet than the first one (default), enter the name of the tab you want to use here. * search – You can search for specific data in your sheet. If you want to use more than one condition join them using & symbol. Example: search=&#034;name=Tom&age=15&#034; * sort-by – The column you want to sort by * sort-order – sort in asc or desc order * lazy-loading – If you set this attribute to true, the api call will be executed only when the user reaches the point of the table. If your table is lower on the page this can help reduce request consumption. HTML rendering and safety: * Using {{name}} renders plain text only. Any HTML is escaped and will not be executed or rendered. * Using {{html:name}} allows most safe HTML tags to render (e.g. a, p, ul, li, strong, em, img with safe attributes). Potentially dangerous tags and attributes (e.g. <script>, <iframe>, <object>, <embed>, inline on* event handlers, and javascript: URLs) are stripped/sanitized. This behavior is intentional for security reasons to prevent XSS and code injection from spreadsheet content. Security recommendation: * For best security, configure your SheetDB API as read-only: enable only GET and disable POST, PATCH, and DELETE. This prevents anyone from modifying your data via exposed API keys or URLs. Additional information: This plugin use SheetDB.io to fetch data from Google Spreadsheet. You must have an account at SheetDB – account is free for 500 requests per month. More information at SheetDB.io or at privacy policy Re-use If you want to re-use your data, you can use the save attribute in your [sheetdb] element. To re-use your data use [sheetdb-slot]. You can use the same data inside as in the parent. To match them the value of save and slot must be the same. Example: [sheetdb url=&#034;https://sheetdb.io/api/v1/58f61be4dda40&#034; save=&#034;slot-name&#034;] {{id}} – {{name}} [/sheetdb] [sheetdb-slot slot=&#034;slot-name&#034;] {{name}} [/sheetdb-slot] That way, you only use 1 request instead of 2. Slots have access to the same data as the parent. You can’t change things like limit or search.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C