VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 112)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 112)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Unauthenticated (Subscriber+) Unauthorized Course Enrollment
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-88848—
Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-88847—
Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.49Update to 3.7.50
CVE-2026-88845—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid≤7.9.4Update to 7.9.5
CVE-2026-84151—
Medium4.3Authenticated (Subscriber+) Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates≤3.4.1Update to 3.4.2
CVE-2026-82850—
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates≤3.4.1Update to 3.4.2
CVE-2026-82849—
High7.5Authenticated (Subscriber+) PHP Object Injection
wpForo Forum≤3.1.5Update to 3.1.6
CVE-2026-80513—
Medium4.3Missing Authorization
CMB2≤2.12.0Update to 2.13.0
CVE-2026-80338—
Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution≤2.1.71Update to 2.1.72
CVE-2026-93344—
Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution≤2.1.71Update to 2.1.72
CVE-2026-93343—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Refund Requests
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution≤2.1.71Update to 2.1.72
CVE-2026-93341—
High8.1Unauthenticated PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.3Update to 3.15.4
CVE-2026-91827—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher≤2.8.25Update to 2.8.26
CVE-2026-89002—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Styler≤1.1.1No patch available
CVE-2026-88788—
Medium4.9Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels≤6.6.43Update to 6.6.44
CVE-2026-15095—
High7.5Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
WP Travel Engine – Tour Booking Plugin – Tour Operator Software≤6.8.0Update to 6.8.1
CVE-2026-9231—
Medium5.3Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
PixelPlay≤1.0.2No patch available
CVE-2025-14486—
Medium5.3Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
Image Buzz≤1.0.3No patch available
CVE-2025-14484—
High8.8Authenticated (Subscriber+) Arbitrary File Deletion
BM Content Builder<3.17.1Update to 3.17.1
CVE-2025-1281—
Medium5.3Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Handily≤1.0.3Update to 1.0.4
CVE-2025-14487—
Medium6.5Authenticated (Subscriber+) Arbitrary File Read
BM Content Builder<3.17.1Update to 3.17.1
CVE-2025-1280—
Medium4.3Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
WP-CRM System – Manage Clients and Projects≤3.4.6Update to 3.4.7
CVE-2026-9004—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More≤6.2.1Update to 6.2.2
CVE-2026-7622—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Live Composer – Free WordPress Website Builder≤2.1.21Update to 2.1.22
CVE-2026-16778—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
Hostel≤1.1.8No patch available
CVE-2026-1645—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
wpForo Forum≤3.1.5Update to 3.1.6
CVE-2026-91092—
High7.2Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
WP Yelp Review Slider≤9.2Update to 9.3
CVE-2026-93778—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory≤2.9.18Update to 2.9.19
CVE-2026-18345—
High7.12.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
WP Table Builder – Drag & Drop Table Builder2.1.1 – 2.1.13Update to 2.1.14
CVE-2026-6922—
High8.1Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard≤1.4.4Update to 1.4.5
CVE-2026-92969—

Search VulnCrest Radar

Jump to

Are you sure?