WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 9 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (33%). Other recurring categories include SQL Injection, Missing Authorization.

Every one of the 15 issues recorded for WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (2) reported by Ananda Dhakal. WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891022.12.2017Today08.11.20217.2WP Data Access <= 4.3.1 - Admin+ SQL Injection CVSS 7.2 · 08.11.202104.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202206.04.20237.5WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation CVSS 7.5 · 06.04.202316.08.20244.3WP Data Access <= 5.5.7 - Cross-Site Request Forgery CVSS 4.3 · 16.08.202424.12.20247.5WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection CVSS 7.5 · 24.12.202416.04.20256.4WP Data Access <= 5.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.04.202513.02.20266.4WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode CVSS 6.4 · 13.02.202630.04.20266.1Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 6.1 · 30.04.202609.05.20267.5WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection CVSS 7.5 · 09.05.202603.08.20265.3Data Access <= 5.5.78 - Missing Authorization CVSS 5.3 · 03.08.202605.08.20267.2WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 05.08.202612.08.20266.4WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 12.08.202619.08.20265.3WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.80 - Missing Authorization CVSS 5.3 · 19.08.202625.08.20265.3WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access CVSS 5.3 · 25.08.202628.08.20267.5WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection CVSS 7.5 · 28.08.2026

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

15

Get automatic notifications for all WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-81293

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

15 records
2026-08-28 00:00CVE-2026-81293
7.5
High
sequence_X0Yes
2026-08-25 00:00CVE-2026-3235
5.3
Medium
type5afeYes
2026-08-19 00:00CVE-2026-66595
5.3
Medium
doc4cashYes
2026-08-12 00:00CVE-2026-73344
6.4
Medium
Ananda DhakalYes
2026-08-05 00:00CVE-2026-66663
7.2
High
dutafiYes
2026-08-03 00:00CVE-2026-18032
5.3
Medium
Farid NarimanovYes
2026-05-09 00:00CVE-2026-42665
7.5
High
Mukhlis AmienYes
2026-04-30 17:17CVE-2024-13362
6.1
Medium
Asaf MozesYes
2026-02-13 18:19CVE-2026-0557
6.4
Medium
Muhammad Yudha - DJYes
2025-04-16 00:00CVE-2025-39582
6.4
Medium
Peter ThaleikisYes
Showing 1–10 of 15 reports
Plugin Profile
Latestv5.5.83

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards

Passionate Programmer Peter

Author

Passionate Programmer Peter

4.9(88)
98/100
Last Updated
2026-09-09 (3d ago)
Active Installs
10,000+
Downloads
864,334
Requires WP
0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2017-12-22 (9y ago)

WP Data Access transforms your WordPress site into a platform for building data-driven applications — without writing a single line of code. With the intuitive App Builder, you can create: Interactive Data Tables – manage and display data with ease Custom Data Forms – collect and process input seamlessly Charts, Maps & Dashboards – visualize data beautifully Role-Based Access – control who can view or manage your data Multilingual Support – 35+ languages ready to use WP Data Access is designed as a true no-code builder: everything works out of the box, intuitive and effortless. For those who want more, a full set of developer hooks makes it possible to fine-tune behavior, extend functionality, or integrate with custom workflows. Hooks are completely optional and invisible to no-code users, but a powerful bonus for developers. App Builder ❤️ The ultimate data-driven Rapid Application Development tool. Build dynamic, interactive apps in minutes with Builders, Managers, and Wizards — all fully customizable with Hooks. * Build dynamic, data-driven apps for both front-end and back-end 📱 * Connect to local and remote databases ⚡ * Real-time build and run capabilities 💻 * Run apps in 35+ languages to reach a global audience 🌍 Table Builder – Create powerful, interactive data tables effortlessly Add static and dynamic data table filtering options 🔍 Real-time computed fields and aggregations for instant insights 📈 A Lookup Wizard to add lookups to your data table 🧙 Inline editing for instant updates 📝 Integrates with the WordPress media library for rich content 📷🎞 Export data tables to PDF, CSV, JSON, XML, SQL, and Excel 📄 Add charts and maps to your data table header and footer 📊 JavaScript hooks to customize data table layout and behavior 🔧 Form Builder – Design forms that adapt to your workflow Grid-based layouts for precise control ➕➖ Master-detail relationships for multi-level data structures 🔄 Lookup and Computed Field Wizards to add functionality instantly 🧙 Interactive client-side validations tied to your database constraints ✅ Full access to the WordPress media library 📷🎞 JavaScript hooks to customize business rules, validations and layout 🔧 Chart Builder – Transform your data into visual insights Google Charts integration 📊 Create charts from SQL queries 📑 Interactively adjustable chart configurations ✔ Print/export charts 🖨📄 Map Builder – Visualize your data geographically Google Maps integration for location-based apps 🌎 Query-driven location visualizations 📍 Interactively adjustable search radius 🔍 Customizable marker content and layout 📌 Dashboard Builder – Centralize insights with customizable widgets Combine all app types into cohesive dashboards ✅ Customize dashboard layouts with flexible positioning and sizing ➕➖ Customizable widgets presenting dynamic and static data Mix real-time data with fixed information for comprehensive overviews 📊 Theme Builder – Make your app truly yours Personalize your app’s appearance with ease 🎨 App Manager – Control your apps with confidence Authorization management based on WordPress user and role principles 🔒 Add apps to back-end menus or front-end pages via shortcodes 🔽🌐 Safe mode to temporarily disable hooks without breaking functionality 🔧 SQL Query Builder Run and schedule SQL queries effortlessly from your WordPress dashboard. Schedule queries to run automatically at defined intervals 🕝 Run batch jobs for automated data exchange across multiple databases 🤝 AI Assistant to generate queries and fix common errors 🤖 Tabbed interface for running multiple queries in parallel ▶ Save and reuse queries – privately or globally 🔄 Built-in safeguards to protect core WordPress tables and ensure data integrity 🔒 Visual Query Builder to create complex queries without writing SQL 🎨 Data Explorer Take full control of your data with a GUI-driven interface. Manage local and remote data 🗺 Perform global search and replace across multiple databases and tables 🔍 Import SQL and CSV files, with ZIP support for handling large datasets 📄 Export data in various formats, including SQL, CSV, JSON, and XML 📄 Rename, copy, truncate, drop, optimize, or alter tables 👤 Advanced table and column options, such as geolocation, and enhanced search ✔ Premium Data Services Connect, sync, and manage remote databases and data files. Compatible with all plugin features ✅ Premium Remote Connection Wizard 🧙 Remote Databases: Connect to SQL Server, Oracle, PostgreSQL, MariaDB, MySQL, and MS Access (file-based) 💻 Remote Data Files: Sync with CSV, JSON, and XML files for dynamic updates (e.g., Google Sheets sync) 📄 Legacy Tools Will be replaced by the App Builder. Featuring Data Tables 🔍 – Replace with Data Table app. Data Forms ✅ – Replace with Data Management app or Registration Form. Maps 🌎 – Replace with Map app. Charts 📊 – Replace with Chart app. Dashboards 🎛️ – Replace with Dashboard app. Use to maintain old solutions 🙏 Use App Builder for new projects 🚀 You can continue to use the legacy tools by staying on the latest Version 5.x (Read more →) Useful Links Plugin Website Demos Tutorials App Builder Documentation Video Tutorials SQL Query Builder Documentation Plugin Settings Documentation Tool Guide Documentation Legacy Documentation

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C