VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 116)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 116)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
Payment Gateway of Stripe for WooCommerce≤5.0.8Update to 5.0.9
CVE-2026-9832—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
WP Composer – The Easiest Page Builder≤1.0.5Update to 1.0.7
CVE-2026-2422—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
OTP Login & Register Woocommerce≤2.7.3Update to 2.7.4
CVE-2026-12402—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.23Update to 2.6.24
CVE-2026-15946—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.23Update to 2.6.24
CVE-2026-15947—
Medium6.5Authenticated (Author+) SQL Injection via 'order' Parameter
Create≤2.5.3Update to 2.5.4
CVE-2026-13200—
Medium6.5Authenticated (Author+) SQL Injection via 'order_by' Parameter
Create≤2.5.3Update to 2.5.4
CVE-2026-13191—
Medium4.9Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
GoPay for WooCommerce≤1.0.34Update to 1.0.35
CVE-2026-75959—
Medium4.3Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites≤4.2.6Update to 5.0.0
CVE-2026-1242—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
Ibtana – Ecommerce Product Addons≤0.4.7.7Update to 0.4.7.8
CVE-2026-1984—
Medium6.4Authenticated (Subscriber+) Cross-Site Scripting via User Input
Redux Framework≤4.5.13Update to 4.5.14
CVE-2026-5400—
Medium4.7Unauthenticated Open Redirect via 'redirect_to' Parameter
Hide My WP Ghost – Security & Firewall≤7.0.02Update to 7.0.03
CVE-2026-7527—
High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.2Update to 4.17.3
CVE-2026-85658—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
Flex Import≤3.0Update to 3.1
CVE-2026-9615—
Medium6.1Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
MC4WP: Mailchimp for WordPress≤4.14.0Update to 4.14.1
CVE-2026-87917—
Medium6.5Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Easy Appointments≤3.12.27Update to 3.12.28
CVE-2026-9232—
Medium6.5Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Custom Field Template≤2.7.8Update to 2.8
CVE-2026-9855—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)≤3.15.3Update to 3.15.4
CVE-2026-13770—
Medium5.3Missing Authorization to Unauthenticated Information Exposure
Bread≤2.9.12Update to 2.9.13
CVE-2026-4792—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Asset CleanUp: Page Speed Booster≤1.4.0.5Update to 1.4.0.6
CVE-2026-13354—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
WP2Social Auto Publish≤2.4.12Update to 2.4.13
CVE-2026-12042—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
WP Recipe Maker≤10.8.1Update to 10.8.2
CVE-2026-89274—
Medium6.1Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-89081—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-88944—
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-89333—
Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
SEO Booster≤7.4.7Update to 7.4.8
CVE-2026-15660—
High8.8Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
Save as PDF Plugin by PDFCrowd≤4.6.1Update to 4.6.2
CVE-2026-92807—
Medium6.1Reflected Cross-Site Scripting via 'keyword' Parameter
Pochipp≤1.20.2Update to 1.20.3
CVE-2026-92967—
Critical9.8Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Gravity Forms≤3.1.0.4Update to 3.1.1
CVE-2026-84434—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.3
CVE-2026-92229—

Search VulnCrest Radar

Jump to

Are you sure?