PLUGIN SECURITY
Is EZ SQL Reports Shortcode Widget and DB Backup safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the EZ SQL Reports Shortcode Widget and DB Backup WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
elisqlreports
Maintenance status
Known vulnerabilities
6 known CVEs on file for EZ SQL Reports Shortcode Widget and DB Backup.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-120688 | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 5.26.45 | Improper Neutralization of Input During Web Page Generation | High 7.2 | < 5.26.45 | 5.26.45 | 2025-06-28 | — |
| CVE-2025-30787 | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 5.25.10 (closed) | Cross-Site Request Forgery (CSRF) | High 7.1 | < 5.25.10 | 5.25.10 | 2025-03-27 | — |
| CVE-2025-30788 | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 5.25.10 (closed) | Cross-Site Request Forgery (CSRF) | High 8.2 | < 5.25.10 | 5.25.10 | 2025-03-27 | — |
| CVE-2025-26887 | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 5.25.08 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 5.25.08 | 5.25.08 | 2025-02-22 | — |
| — | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] >= 4.11.13 - < 5.25.10 (closed) | Cross-Site Request Forgery (CSRF) | High 8.8 | 4.11.13–5.25.10 | 5.25.10 | 0000-00-00 | — |
| — | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 5.25.25 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 5.25.25 | 5.25.25 | 0000-00-00 | — |
| — | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 4.11.37 (closed) | — | Unknown | < 4.11.37 | 4.11.37 | — | — |
| — | EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 4.11.37 (closed) | — | Unknown | < 4.11.37 | 4.11.37 | — | — |
+ 4 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | EZ SQL Reports < 4.11.37 - Authenticated Arbitrary File Download | — | Unknown | < 4.11.37 | 4.11.37 | — | — |
| — | EZ SQL Reports < 4.11.37 - Authenticated Arbitrary Code Execution | — | Unknown | < 4.11.37 | 4.11.37 | — | — |
| CVE-2025-2319 | EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution | — | Unknown | < 5.25.10 | 5.25.10 | — | — |
| CVE-2025-6462 | EZ SQL Reports Shortcode Widget and DB Backup < 5.25.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode | — | Unknown | < 5.25.25 | 5.25.25 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.