WordPress security by component

PickPlugins Question Answer

Plugin description

PickPlugins Question Answer is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jul 28, 2026; the highest CVE/CNA score is 8.8.

Plugin slug: question-answer

Latest vulnerability

CVE-2026-10207: PickPlugins Question Answer exposes unauthenticated SQL injection through user profiles

PickPlugins Question Answer through 1.2.73 accepts an unauthenticated id GET parameter in its user-profile template. The value passes through wp_unslash() and is concatenated directly into a database query by qa_user_profile_card() without escaping or a prepared statement, allowing an attacker to append SQL and extract sensitive database information. The CNA record does not disclose the public page or route that renders the profile template or the exact query. No fixed public release is identified, and the WordPress.org plugin entry and cited source are no longer publicly available.

PublishedJul 28, 2026

Safe version guidanceSee mitigation notes

		Safe version
Jul 28, 2026	CVE-2026-10207 PickPlugins Question Answer exposes unauthenticated SQL injection through user profiles PickPlugins Question Answer through 1.2.73 accepts an unauthenticated id GET parameter in its user-profile template. The value passes through wp_unslash() and is concatenated directly into a database query by qa_user_profile_card() without escaping or a prepared statement, allowing an attacker to append SQL and extract sensitive database information. The CNA record does not disclose the public page or route that renders the profile template or the exact query. No fixed public release is identified, and the WordPress.org plugin entry and cited source are no longer publicly available.	See mitigation notes	CVE7.5 NVDPending
Apr 17, 2025	CVE-2025-32647 Question Answer: Code execution Question Answer is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8 NVDPending
Apr 17, 2025	CVE-2025-32646 Question Answer: Cross-site scripting Question Answer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVDPending
Apr 01, 2025	CVE-2025-31810 Question Answer: A security weakness Question Answer is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending