CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1234)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Arbitrary Tab Modification
Tab – Accordion, FAQ
<1.3.2Update to 1.3.2
- Medium6.1Reflected Cross-Site Scripting
UpdraftPlus Premium
<1.16.66Update to 1.16.66
- Medium6.1Reflected Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.6.1Update to 2.6.2
- High7.5Denial of Service
Stars Rating
<3.5.1Update to 3.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3
- Medium4.8Reflected Cross-Site Scripting via tab and section parameter
PDF Invoices & Packing Slips for WooCommerce
<2.10.5Update to 2.10.5
- High8.8SQL Injection
WPcalc – create any online calculators
≤2.1No patch available
- High8.8Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery
WP Coder – Insert & Manage Code Snippets
≤2.5.1Update to 2.5.2
- High8.8Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.2Update to 2.3.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Modal Window – create popup modal window
<5.2.2Update to 5.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤2.0.6Update to 2.0.7
- Medium5.4Subscriber+ Category Add Leading to Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.1.6Update to 6.2.0
- Medium5.4Cross-Site Scripting
Customize Login Image
≤3.4Update to 3.5
- Medium4.3Missing Authorization on Option Changes
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- High7.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.4Cross-Site Scripting
Post Duplicator
<2.24Update to 2.24
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Variation Swatches for WooCommerce
≤2.1.1Update to 2.1.2
- Medium6.1Reflected Cross-Site Scripting in General Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in Product XML Feeds Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in PDF Invoicing Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium5.5Editor+ Stored Cross-Site Scripting
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤5.3.0Update to 5.3.1
- Medium4.9Admin+ Arbitrary Folder Deletion via Path Traversal
CAOS | Host Google Analytics Locally
≤4.1.8Update to 4.1.9
- Medium4.9Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.11Update to 4.5.12
- Medium6.1Reflected Cross-Site Scripting via qc_res
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- Medium6.5Authorization Bypass
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- High8.8Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.7Update to 1.6.8
- Medium6.4Cross-Site Scripting
Download Manager
<3.2.22Update to 3.2.22
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Typebot
<1.4.3Update to 1.4.3
- Medium6.1Reflected Cross-Site Scripting
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available