CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 118)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.4Update to 7.5.5
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- Medium6.5Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.44Update to 1.8.45
- High7.5Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
WP Multi Store Locator Pro
≤4.5.1Update to 4.5.2
- Medium6.1Reflected Cross-Site Scripting via Query-String Parameter Name
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.5.1Update to 3.5.2
- High8.8Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter
Mapster WP Maps
≤1.23.0Update to 1.24.0
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.3Update to 5.6.4
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
FileBird – WordPress Media Library Folders & File Manager
≤6.5.6Update to 6.5.7
- High7.5Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
Location Manager
≤2.3.38Update to 2.3.39
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
Kubio AI Page Builder
≤2.8.4Update to 2.8.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.0Update to 9.3.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
WP Inventory Manager
≤2.5.1Update to 2.5.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Medium4.9Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.8.0Update to 2.8.1
- High7.5Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
VK All in One Expansion Unit
≤9.118.0Update to 9.119.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Strong Testimonials
≤3.3.8Update to 3.3.9
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Qi Addons For Elementor
≤1.11Update to 1.11.1
- High7.5Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.8.5Update to 2.8.6
- Medium6.1Reflected Cross-Site Scripting via 'nn' Parameter
Newsletter – Send awesome emails from WordPress
≤9.3.8Update to 9.3.9
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.6Update to 1.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.6Update to 1.8.7
- Medium6.5Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
InfiniteWP Client
≤1.13.9Update to 1.13.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
≤2.5.3Update to 2.5.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
Filter Gallery
≤1.1.4Update to 1.1.5
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
Filter Gallery
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
EmbedPress
≤4.6.5Update to 4.6.6