CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1235)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8SQL Injection
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available
- High8.8Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting
Stetic
≤1.0.6Update to 1.0.7
- Medium4.8Authenticated Stored Cross-Site Scripting
Asgaros Forum
≤1.15.13Update to 1.15.14
- Medium4.8Smart Floating Action Button <= 2.5.4 - Admin+ Stored Cross-Site Scripting
Buttonizer – Floating Menus, Sticky Buttons, & Popup Builder
≤2.5.4Update to 2.5.5
- High8.8SQL Injection
Rich Reviews by Starfish
<1.9.6Update to 1.9.6
- Medium5.3Sensitive Data Exposure
CorreosExpress – Shipping Management – Tags
≤2.6.0No patch available
- Medium5.4Subscriber+ Stored Cross-Site Scripting
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
<4.19.3Update to 4.19.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Lead Form Builder & Contact Form
≤1.6.3Update to 1.6.4
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
≤4.3.20Update to 4.3.21
- Medium6.1Reflected Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.0.6Update to 6.0.7
- High8.8Cross-Site Request Forgery
Browser and Operating System Finder
<1.2Update to 1.2
- High8.1Dependency Confusion
WordPress
≤5.7.5Update to 5.8
- High7.5Authorization Bypass
Hide My WP - Amazing Security Plugin for WordPress!
≤6.2.3Update to 6.2.4
- High8.6SQL Injection
Hide My WP - Amazing Security Plugin for WordPress!
≤6.2.3Update to 6.2.4
- Medium6.1Reflected Cross-Site Scripting
WPFront User Role Editor
≤3.2.0Update to 3.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Tickera – Sell Tickets & Manage Events
≤3.4.8.2Update to 3.4.8.3
- Medium5.5Authenticated Stored Cross-Site Scripting
HTML5 Responsive FAQ
≤2.8.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.6.6Update to 2.6.6
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Cybersoldier
<1.7.0Update to 1.7.0
- Medium6.1Reflected Cross-Site Scripting
Gwolle Guestbook
≤4.1.2Update to 4.2
- Medium6.1Reflected Cross-Site Scripting
IDPay for Contact Form 7
≤2.1.2Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
<1.8.0Update to 1.8.0
- High7.2SQL Injection
ExportFeed: List WooCommerce Products on eBay Store
≤2.0.1.0No patch available
- Medium4.3Unauthorised Private Post Access
Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery
≤3.4.1Update to 3.4.2
- Medium5.4Contributor+ Stored Cross-Site Scripting
Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery
≤3.4.1Update to 3.4.2
- Critical9.8WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.4.11Update to 3.4.12
- Medium6.5Information Disclosure
WP Guppy
<1.3Update to 1.3
- High8.8SQL Injection
Ni WooCommerce Custom Order Status
≤1.9.6Update to 1.9.7
- Medium6.1Reflected Cross-Site Scripting via message_id
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<2.0.5Update to 2.0.5
- Medium6.5Stored Cross-Site Scripting
Logo Carousel
<1.7.2Update to 1.7.2