CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1237)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
Security Audit
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery
Wp Limits
≤1.0No patch available
- Medium6.5Cross-Site Request Forgery
Filter Portfolio Gallery
≤1.5No patch available
- Medium4.3Authenticated (Contributor+) Arbitrary Posts/Pages Access
Improved Include Page
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting via ppress_cc_data Parameter
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium6.1Cross-Site Scripting
Activity Log for WordPress
<1.0.21Update to 1.0.21
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.2Update to 2.6.3
- Critical9.8Unauthenticated Blind SQL Injection via time Parameter
Modern Events Calendar Lite
<6.1.5Update to 6.1.5
- Medium5.5Stored Cross-Site Scripting
Inspirational Quote Rotator
≤1.0.0No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.4.2Update to 8.4.3
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.2.3Update to 1.2.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤6.1.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Database Addon for Contact Form 7 – CFDB7
≤1.2.6.1Update to 1.2.6.2
- High8.8Authenticated Arbitrary File Upload
WP Popular Posts
≤5.3.2Update to 5.3.3
- Medium6.5Cross-Site Request Forgery
Database Addon for Contact Form 7 – CFDB7
≤1.2.5.9Update to 1.2.6.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form Email
≤1.3.24Update to 1.3.25
- Medium6.5Unauthorised Vote Export to Email & IP Addresses Disclosure
Like Button Rating ♥ LikeBtn
≤2.6.37Update to 2.6.38
- Medium4.8Admin+ Stored Cross-Site Scripting
Caldera Forms – More Than Contact Forms
<1.9.5Update to 1.9.5
- High8.8Cross-Site Request Forgery
WP Reset
5.00 – 5.98Update to 5.99
- High8.8Missing Authorization to Database Reset
WP Reset
5.00 – 5.98Update to 5.99
- Medium5.4Authenticated Stored Cross-Site Scripting
Meks Easy Photo Feed Widget
<1.2.4Update to 1.2.4
- Medium6.1Reflected Cross-Site Scripting
Booking Package
<1.5.11Update to 1.5.11
- Medium5.5Arbitrary File Deletion
Error Log Viewer by BestWebSoft
≤1.1.1Update to 1.1.2
- Critical9.8Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.1.4Update to 4.1.4
- Medium6.4Contributor+ Stored Cross-Site Scripting
Get Custom Field Values
<4.0.1Update to 4.0.1
- Medium6.5Arbitrary Post Metadata Access
Get Custom Field Values
<4.0Update to 4.0
- Critical9.8Unauthenticated SQL Injection
Registrations for the Events Calendar – Event Registration Plugin
<2.7.6Update to 2.7.6
- Medium5.4Staff Member Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤20.3Update to 20.3.1
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7Update to 1.3.7.1