CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1240)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.7Cross-Site Request Forgery
Download Plugin
<1.6.1Update to 1.6.1
- High7.5SQL Injection
Mang Board
≤1.9.9Update to 2.0.0
- Medium6.5SQL Injection
Duplicate Post
<1.2.0Update to 1.2.0
- Medium5.4Stored Cross-Site Scripting
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.4Update to 1.2.4
- High8.1Cross-Site Request Forgery
Images to WebP
<1.9Update to 1.9
- Medium5.5Stored Cross-Site Scripting via $custom_profile
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3.1Update to 4.1.3.2
- Medium4.3Cross-Site Request Forgery
QR Redirector
<1.6Update to 1.6
- Medium4.8Authenticated Stored Cross-Site Scripting
Sprout Invoices – Client Invoicing & Estimates
<19.9.7Update to 19.9.7
- High7.2Admin+ SQL Injection
Email Log
≤2.4.6Update to 2.4.7
- Medium6.4Contributor+ Stored Cross-Site Scripting
Insert Pages
≤3.6.1Update to 3.7.0
- Medium5.4Stored Cross-Site Scripting
QR Redirector
<1.6.1Update to 1.6.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting
My Tickets – Accessible Event Ticketing
<1.8.31Update to 1.8.31
- Medium6.1Responsive Multi-Purpose Theme < 4.8.4 - Reflected Cross-Site Scripting
enfold
<4.8.4Update to 4.8.4
- Medium4.8Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.61Update to 1.6.61
- Medium4.3Settings Change via Cross-Site Request Forgery
WP Performance Score Booster – Optimize Speed, Enable Cache & Page Preload
≤2.0Update to 2.1
- High7.2Admin+ SQL Injection
Stream – Activity Log & Audit Trail
≤3.8.1Update to 3.8.2
- Medium5.5Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site Scripting
Leaky Paywall
≤4.16.5Update to 4.16.6
- Medium6.5Plugin's Setting Update via Cross-Site Request Forgery
MouseWheel Smooth Scroll
≤5.6Update to 5.7
- Medium4.8Admin+ Stored Cross-Site Scripting
Accept Donations with PayPal & Stripe
≤1.3.1Update to 1.3.2
- High8.8Subscriber+ SQL Injection
SEO Redirection Plugin – 301 Redirect Manager
≤8.1Update to 8.2
- Medium4.3Contributor+ Arbitrary Posts/Pages Access
Insert Pages
≤3.6.1Update to 3.7.0
- Medium5.5Admin+ Stored Cross-Site Scripting
Helpful
<4.4.59Update to 4.4.59
- Medium5.4Authenticated Stored Cross-Site Scripting
Microsoft Clarity
≤0.3Update to 0.4
- High8.8Cross-Site Request Forgery
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.2.1Update to 3.2.1
- High8.1Cross-Site Request Forgery
Support Board
<3.3.6Update to 3.3.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Content Staging
≤2.0.1No patch available
- High7.2Admin+ SQL Injection
Speed Booster Pack ⚡ PageSpeed Optimization Suite
≤4.3.3Update to 4.3.3.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Indeed Job Importer
≤1.0.5No patch available
- Medium5.5Stored Cross-Site Scripting
JobBoardWP – Job Board Listings and Submissions
≤1.0.7Update to 1.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MPL-Publisher — Ebook & Audiobook Creator
≤1.30.2Update to 1.30.3