CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1238)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Email Log
≤2.4.7Update to 2.4.8
- High8.0Missing Authorization to Visitor Monitoring & Chat Removal
Tawk.To Live Chat
<0.6.0Update to 0.6.0
- Medium6.1Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter
LoginWP (Formerly Peter's Login Redirect)
<3.0.0.5Update to 3.0.0.5
- High7.2Admin+ SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤4.3.1Update to 5.0.0
- Critical9.8Unauthenticated SQL Injection
Secure Copy Content Protection and Content Locking
≤2.8.1Update to 2.8.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
≤1.6.1Update to 1.6.2
- Medium6.1Reflected Cross-Site Scripting
WP Google Fonts
≤3.1.4Update to 3.1.5
- Medium5.3Unauthenticated Information Disclosure
Visual Form Builder
<3.0.6Update to 3.0.6
- Medium5.3CSV Injection
Visual Form Builder
<3.0.6Update to 3.0.6
- Medium5.5Cross-Site Scripting
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
<1.5Update to 1.5
- Medium4.8Authenticated Stored Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.6.3Update to 3.6.3
- Medium5.4Cross-Site Request Forgery
Email Tracker
≤5.2.6Update to 5.2.7
- Medium4.8Stored Cross-Site Scripting
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.9.33Update to 1.10.1
- High8.2Unprotected REST-API Endpoints
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.4Update to 2.6.5
- Medium4.8Admin+ Stored Cross-Site Scripting
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
≤4.19.1Update to 4.19.2
- High7.2Admin+ SQL Injection
BSK PDF Manager
<3.1.2Update to 3.1.2
- Medium4.8Authenticated Cross-Site Scripting
Shop Page WP
<1.2.8Update to 1.2.8
- Medium5.4Subscriber+ Reflected Cross-Site Scripting
My Calendar – Accessible Event Manager
≤3.2.17Update to 3.2.18
- Medium6.1Reflected Cross-Site Scripting
Check & Log Email – Easy Email Testing & Mail logging
<1.0.4Update to 1.0.4
- High7.2Admin+ SQL Injection
Email Before Download
≤6.7Update to 6.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GenerateBlocks
≤1.3.5Update to 1.4.0
- Medium5.4Stored Cross-Site Scripting
Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator
≤7.0.3Update to 7.0.4
- High8.8Subscriber+ SQL Injection
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤2.2Update to 2.3
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
≤4.4.6Update to 4.4.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Download Monitor
≤4.4.6Update to 4.4.7
- Medium6.8Authenticated (Admin+) Arbitrary File Download
Download Monitor
≤4.4.6Update to 4.4.7
- Medium5.4Arbitrary Plugin Settings Update to Stored Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
<4.0.1Update to 4.0.1
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Medium4.3Cross-Site Request Forgery
URL Shortify – Simple and Easy URL Shortener
≤1.5.0Update to 1.5.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Social Media Flying Icons | Floating Social Media Icon
≤4.3.5No patch available