VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1242)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1242)
SeverityVulnerabilityCVEInstallsPublished
High8.8Cross-Site Request Forgery
WP SEO Redirect 301<2.3.2Update to 2.3.2
CVE-2021-24832—
Medium6.5Authenticated PHP Code Injection
Loco Translate<2.5.4Update to 2.5.4
CVE-2021-24721—
Medium6.1Reflected Cross-Site Scripting
WP Header Images<2.0.1Update to 2.0.1
CVE-2021-24798—
High8.1Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction<3.7.1.6Update to 3.7.1.6
CVE-2021-24647—
Critical9.8Unauthenticated SQL Injection
Asgaros Forum≤1.15.12Update to 1.15.13
CVE-2021-24827—
High7.2Authenticated SQL Injections
Header Footer Code Manager<1.1.14Update to 1.1.14
CVE-2021-24791—
High7.2Admin+ SQL injection
Affiliates Manager≤2.8.6Update to 2.8.7
CVE-2021-24844—
High8.8SQL Injection
School Management System – WPSchoolPress<2.1.10Update to 2.1.10
CVE-2021-24575—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Storefront Footer Text≤1.0.1No patch available
CVE-2021-24607—
High8.8Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
WCFM – Frontend Manager for WooCommerce≤6.5.11Update to 6.5.12
CVE-2021-24835—
Medium4.8Admin+ Stored Cross-Site Scripting
Print-O-Matic≤2.0.2Update to 2.0.3
CVE-2021-24710—
Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction≤3.7.1.4Update to 3.7.1.5
CVE-2025-34077—
Medium5.5Stored Cross-Site Scripting
Qwizcards | online quizzes and flashcards≤3.61Update to 3.62
CVE-2021-24706—
Medium4.8Stored Cross-Site Scripting
School Management System – WPSchoolPress<2.1.17Update to 2.1.17
CVE-2021-24664—
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Comment Engine Pro≤1.0No patch available
CVE-2021-36911—
High7.2Authenticated (Admin+) SQL Injection
Post Content XMLRPC≤1.0No patch available
CVE-2021-24629—
High8.8Cross-Site Request Forgery
Chameleon CSS≤1.2No patch available
CVE-2021-24626—
High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink≤1.0.1No patch available
CVE-2021-24627—
Medium6.4Agent+ Stored Cross-Site Scripting
Support Board≤3.3.4Update to 3.3.5
CVE-2021-24807—
High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style≤3.1.3No patch available
CVE-2021-24628—
High7.2Authenticated (Admin+) SQL Injection
Unlimited PopUps≤4.5.3No patch available
CVE-2021-24631—
High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog≤1.7.3No patch available
CVE-2021-24625—
High8.8Authenticated (Author+) SQL Injection
Schreikasten≤0.14.18No patch available
CVE-2021-24630—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival≤1.4.2Update to 1.4.3
CVE-2021-39317—
Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel<1.3.1Update to 1.3.1
CVE-2021-24708—
Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs≤1.7.8Update to 1.7.9
CVE-2021-24767—
Medium4.3Cross-Site Request Forgery
Genie WP Favicon≤0.5.2No patch available
CVE-2021-24674—
Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename≤3.4.2Update to 3.4.4
CVE-2021-24816—
Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<5.0.07Update to 5.0.07
CVE-2021-24608—
High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics≤3.8Update to 3.9
CVE-2021-24829—

Search VulnCrest Radar

Jump to

Are you sure?