CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 107)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via first_name Parameter
BA Book Everything
≤1.8.27Update to 1.8.28
- Critical9.8Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Wawp Country Code & Chat Widget for WooCommerce
≤4.8.6Update to 4.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
AMP for WP – Accelerated Mobile Pages
≤1.1.16Update to 1.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
Fancy Product Designer
≤6.5.2Update to 6.5.3
- Medium4.3Authenticated (Subscriber+) Information Exposure
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.5.5Update to 6.5.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High8.8Authenticated (Contributor+) Remote Code Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.2.0Update to 3.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Table & List Builder for WooCommerce
≤5.6.7Update to 5.6.9
- Medium5.3Missing Authorization
Testimonials Widget
≤4.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
YITH WooCommerce Ajax Search
≤2.28.0Update to 2.28.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Simply Schedule Appointments
≤1.6.12.31Update to 1.6.12.33
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.27Update to 6.4.28
- Medium4.3Authenticated (Contributor+) Information Exposure
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.3Authenticated (Shop Worker+) Privilege Escalation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.7.2Update to 4.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
≤20.8.17Update to 20.8.18
- High7.2Unauthenticated Stored Cross-Site Scripting
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.26.15Update to 1.26.16
- Medium4.3Cross-Site Request Forgery
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
≤2.3.1Update to 2.3.2
- Medium6.6Authenticated (Editor+) PHP Object Injection
Ultra Addons for Contact Form 7
≤3.5.51Update to 3.5.52
- Medium6.3Authenticated (Subscriber+) Security Control Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.4.8Update to 5.4.9
- Medium5.3Missing Authorization
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0
- High7.2Unauthenticated Server-Side Request Forgery
Testimonials Widget
≤4.0.4No patch available
- Medium6.44.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.12Update to 4.2.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- High7.5Unauthenticated Denial of Service
WP Store Locator
<3.0.0Update to 3.0.0