CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1239)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Registrations for the Events Calendar – Event Registration Plugin
≤2.7.4Update to 2.7.5
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.9.0Update to 1.9.1
- High8.1Missing Authorization to Database Wipe
HashThemes Demo Importer
≤1.1.1Update to 1.1.2
- High7.2Authenticated SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.6.4Update to 3.6.4
- Medium6.4Cross-Site Scripting
About Author Box
<1.0.2Update to 1.0.2
- Medium5.4Missing Authorisation
Bulk Datetime Change
<1.12Update to 1.12
- Medium6.1eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting
eCommerce Product Catalog
<3.0.39Update to 3.0.39
- Medium6.5Denial of Service
Reviews Plus
<1.2.14Update to 1.2.15
- Medium4.3Cross-Site Request Forgery
MAZ Loader – Preloader Builder for WordPress
≤1.4.0Update to 1.4.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Media Tags
≤3.2.0.2No patch available
- Medium4.8Admin+ Stored Cross-Site Cross-Site Scripting
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤4.1.7Update to 4.1.8
- Medium5.5Authenticated Stored Cross-Site Scripting
Notification – Custom Notifications and Alerts for WordPress
≤7.2.4Update to 8.0.0
- Medium5.4Contributor+ Stored Cross-Site Scripting
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Editable Table Simple Fast FrontEnd From Sql tables
≤0.1.4No patch available
- Medium5.5Stored Cross-Site Scripting
CM Video Lessons Manager – Simplify video lessons management for better education
≤1.7.1Update to 1.7.2
- High7.2SQL Injection via orderby, order Parameters
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<4.1.8Update to 4.1.8
- Medium4.8Cross-Site Scripting
Slideshow Gallery LITE
<1.7.4Update to 1.7.4
- Medium4.3Cross-Site Request Forgery
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.5Update to 1.2.5
- High8.8Object Injection
Social Sharing Plugin – Sassy Social Share
3.3.23 – 3.3.23Update to 3.3.24
- Medium4.8Reflected Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.11.2Update to 2.11.2.1
- Medium5.5Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
Simple Job Board
≤2.9.4Update to 2.9.5
- High7.2Arbitrary File Upload
Catch Themes Demo Import
≤1.7Update to 1.8
- High8.8Cross-Site Request Forgery
Core Tweaks WP Setup
≤4.1No patch available
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Template Kit – Import
≤1.0.13Update to 1.0.14
- High7.2Admin+ SQL Injection via orderby parameter
Download Monitor
<4.4.5Update to 4.4.5
- Medium4.8Admin+ Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.15.4Update to 1.15.4
- Medium5.4Stored Cross-Site Scripting
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
<1.2.6Update to 1.2.6
- Medium6.1Reflected Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.10Update to 1.9.11
- Medium4.8Admin+ Stored Cross-Site Scripting
Access Governance for WordPress (aka AAM)
<6.8.0Update to 6.8.0
- Medium5.4Stored Cross-Site Scripting
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.4Update to 1.2.4