broken SQL queries (no escaping)

The code in this plugin doesn’t escape values before inserting them into SQL, so it breaks if you have plugins that add anything with single quotes to thumbnails something something. Anyway, near the bottom of category-thumbnails.php replace this line:

$wpdb->query(sprintf('UPDATE <code>%sterm_taxonomy</code> SET

term_thu

with this:

if ($data !== NULL) {
$data = base64_decode($data);
}
$wpdb->update(
$wpdb->prefix . ‘term_taxonomy’,
array(‘term_thumbnail’ => $data),
array(‘term_id’ => $category)
);
`

And now maybe the plugin will start working, and you own’t accidentally bork your entire database.

https://wordpress.org/plugins/category-thumbnails/