WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps has 20 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 20 are fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 8 high. 2026 was the busiest year with 14 disclosures.

The most common weakness is SQL Injection, behind 6 of the records (30%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 20 issues recorded for WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps has a vendor fix available, so running the current release closes all known holes.

16 independent researchers contributed these findings, most of them (3) reported by Raphael P. Cigana. WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891022.12.2017Today08.11.20217.2WP Data Access <= 4.3.1 - Admin+ SQL Injection CVSS 7.2 · 08.11.202104.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202206.04.20237.5WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation CVSS 7.5 · 06.04.202316.08.20244.3WP Data Access <= 5.5.7 - Cross-Site Request Forgery CVSS 4.3 · 16.08.202424.12.20247.5WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection CVSS 7.5 · 24.12.202416.04.20256.4WP Data Access <= 5.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.04.202513.02.20266.4WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode CVSS 6.4 · 13.02.202630.04.20266.1Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 6.1 · 30.04.202609.05.20267.5WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection CVSS 7.5 · 09.05.202603.08.20265.3Data Access <= 5.5.78 - Missing Authorization CVSS 5.3 · 03.08.202605.08.20267.2WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 05.08.202612.08.20266.4WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 12.08.202619.08.20265.3WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.80 - Missing Authorization CVSS 5.3 · 19.08.202625.08.20265.3WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access CVSS 5.3 · 25.08.202628.08.20267.5WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection CVSS 7.5 · 28.08.202625.09.20267.5WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.84 - Unauthenticated SQL Injection CVSS 7.5 · 25.09.202602.10.20267.5WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.82 - Unauthenticated SQL Injection CVSS 7.5 · 02.10.202614.10.20265.3WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.84 - Unauthenticated Information Exposure CVSS 5.3 · 14.10.20265.3WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.77 - Missing Authorization CVSS 5.3 · 14.10.202615.10.20266.4Data Access <= 5.5.87 - Authenticated (Subscriber+) Server-Side Request Forgery CVSS 6.4 · 15.10.2026

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

20

Get automatic notifications for all WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-95605

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.82 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

20 records
2026-10-15 00:00CVE-2026-106470
6.4
Medium
Raphael P. CiganaYes
2026-10-14 00:00CVE-2026-106099
5.3
Medium
Raphael P. CiganaYes
2026-10-14 00:00CVE-2026-106098
5.3
Medium
Muni Nitish Kumar YaddalaYes
2026-10-02 09:04CVE-2026-95605
7.5
High
neurotxYes
2026-09-25 00:00CVE-2026-93621
7.5
High
Raphael P. CiganaYes
2026-08-28 00:00CVE-2026-81293
7.5
High
sequence_X0Yes
2026-08-25 00:00CVE-2026-3235
5.3
Medium
type5afeYes
2026-08-19 00:00CVE-2026-66595
5.3
Medium
doc4cashYes
2026-08-12 00:00CVE-2026-73344
6.4
Medium
Ananda DhakalYes
2026-08-05 00:00CVE-2026-66663
7.2
High
dutafiYes
Showing 1–10 of 20 reports
Plugin Profile
Latestv5.5.89

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps

Passionate Programmer Peter

Author

Passionate Programmer Peter

4.9(88)
98/100
Last Updated
2026-10-23 (5d ago)
Active Installs
10,000+
Downloads
908,596
Requires WP
0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2017-12-22 (9y ago)

WP Data Access transforms your WordPress site into a platform for building data-driven applications — without writing a single line of code. With the intuitive App Builder, you can create: Interactive Data Tables – manage and display data with ease Custom Data Forms – collect and process input seamlessly Dashboards, Charts & Maps – visualize data beautifully Role-Based Access – control who can view or manage your data Multilingual Support – 35+ languages ready to use WP Data Access is designed as a true no-code builder: everything works out of the box, intuitive and effortless. For those who want more, a full set of developer hooks makes it possible to fine-tune behavior, extend functionality, or integrate with custom workflows. Hooks are completely optional and invisible to no-code users, but a powerful bonus for developers. App Builder ❤️ The ultimate data-driven Rapid Application Development tool. Build dynamic, interactive apps in minutes with Builders, Managers, and Wizards — all fully customizable with Hooks. * Build dynamic, data-driven apps for both front-end and back-end 📱 * Connect to local and remote databases ⚡ * Real-time build and run capabilities 💻 * Run apps in 35+ languages to reach a global audience 🌍 Table Builder – Create powerful, interactive data tables effortlessly Add static and dynamic data table filtering options 🔍 Real-time computed fields and aggregations for instant insights 📈 A Lookup Wizard to add lookups to your data table 🧙 Inline editing for instant updates 📝 Integrates with the WordPress media library for rich content 📷🎞 Export data tables to PDF, CSV, JSON, XML, SQL, and Excel 📄 Add charts and maps to your data table header and footer 📊 JavaScript hooks to customize data table layout and behavior 🔧 Form Builder – Design forms that adapt to your workflow Grid-based layouts for precise control ➕➖ Master-detail relationships for multi-level data structures 🔄 Lookup and Computed Field Wizards to add functionality instantly 🧙 Interactive client-side validations tied to your database constraints ✅ Full access to the WordPress media library 📷🎞 JavaScript hooks to customize business rules, validations and layout 🔧 Chart Builder – Transform your data into visual insights Google Charts integration 📊 Create charts from SQL queries 📑 Interactively adjustable chart configurations ✔ Print/export charts 🖨📄 Map Builder – Visualize your data geographically Google Maps integration for location-based apps 🌎 Query-driven location visualizations 📍 Interactively adjustable search radius 🔍 Customizable marker content and layout 📌 Dashboard Builder – Centralize insights with customizable widgets Combine all app types into cohesive dashboards ✅ Customize dashboard layouts with flexible positioning and sizing ➕➖ Customizable widgets presenting dynamic and static data Mix real-time data with fixed information for comprehensive overviews 📊 Theme Builder – Make your app truly yours Personalize your app’s appearance with ease 🎨 App Manager – Control your apps with confidence Authorization management based on WordPress user and role principles 🔒 Add apps to back-end menus or front-end pages via shortcodes 🔽🌐 Safe mode to temporarily disable hooks without breaking functionality 🔧 SQL Query Builder Run and schedule SQL queries effortlessly from your WordPress dashboard. Schedule queries to run automatically at defined intervals 🕝 Run batch jobs for automated data exchange across multiple databases 🤝 AI Assistant to generate queries and fix common errors 🤖 Tabbed interface for running multiple queries in parallel ▶ Save and reuse queries – privately or globally 🔄 Built-in safeguards to protect core WordPress tables and ensure data integrity 🔒 Visual Query Builder to create complex queries without writing SQL 🎨 Data Explorer Take full control of your data with a GUI-driven interface. Manage local and remote data 🗺 Perform global search and replace across multiple databases and tables 🔍 Import SQL and CSV files, with ZIP support for handling large datasets 📄 Export data in various formats, including SQL, CSV, JSON, and XML 📄 Rename, copy, truncate, drop, optimize, or alter tables 👤 Advanced table and column options, such as geolocation, and enhanced search ✔ Premium Data Services Connect, sync, and manage remote databases and data files. Compatible with all plugin features ✅ Premium Remote Connection Wizard 🧙 Remote Databases: Connect to SQL Server, Oracle, PostgreSQL, MariaDB, MySQL, and MS Access (file-based) 💻 Remote Data Files: Sync with CSV, JSON, and XML files for dynamic updates (e.g., Google Sheets sync) 📄 Legacy Tools Will be replaced by the App Builder. Featuring Data Tables 🔍 – Replace with Data Table app. Data Forms ✅ – Replace with Data Management app or Registration Form. Maps 🌎 – Replace with Map app. Charts 📊 – Replace with Chart app. Dashboards 🎛️ – Replace with Dashboard app. Use to maintain old solutions 🙏 Use App Builder for new projects 🚀 You can continue to use the legacy tools by staying on the latest Version 5.x (Read more →) Useful Links Plugin Website Demos Tutorials App Builder Documentation Video Tutorials SQL Query Builder Documentation Plugin Settings Documentation Tool Guide Documentation Legacy Documentation

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C