CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1246)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Customer Support Ticket System & Helpdesk
<5.10.4Update to 5.10.4
- Medium6.4Cross-Site Scripting
Easy Feeds for X/Twitter – keep your site fresh with live social posts
<1.2Update to 1.2
- Medium6.5Cross-Site Request Forgery
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Critical9.8Authentication Bypass via Password Reset
YITH Easy Login & Register Popup for WooCommerce
≤1.8.0Update to 1.8.1
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium5.4Reflected Cross-Site Scripting
eID Easy
≤4.6Update to 4.7
- Medium5.3Sensitive Information Disclosure
BulletProof Security
≤5.1Update to 5.2
- Medium6.9Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.7Update to 1.3.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.57Update to 1.6.57
- Critical9.9Authenticated Command Injection
WordPress PDF Light Viewer Plugin
≤1.4.11Update to 1.4.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
PlanSo Forms
≤2.6.4No patch available
- Medium4.3Setting Change via Cross-Site Request Forgery
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium6.4Contributor+ Stored Cross-Site Scripting
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤1.7.12Update to 1.7.13
- Medium6.4Stored Cross-Site Scripting
Podcast Subscribe Buttons
<1.4.2Update to 1.4.2
- Medium5.3Sensitive Information Disclosure
Find My Blocks – Locate blocks on your site
<3.4.0Update to 3.4.0
- Medium4.8wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.3.0Update to 7.3.2
- Medium4.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.1.17Update to 2.1.18
- Critical9.8Arbitrary File Upload
Download from files
≤1.48No patch available
- High7.5Unauthenticated SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.4.2Update to 3.4.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Coming soon and Maintenance mode
<3.5.3Update to 3.5.3
- Medium6.5Missing Authorization
CURCY - WooCommerce Multi Currency - Currency Switcher
≤2.1.17Update to 2.1.18
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Domain Deletion
Software License Manager
<4.5.1Update to 4.5.1
- Medium4.8Admin+ Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.1Update to 7.3.2
- Medium4.8Admin+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.3Update to 3.2.4
- High8.8Authenticated (Contributor+) Code Injection
Gutenberg Block Editor Toolkit – EditorsKit
≤1.31.5Update to 1.31.6
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.13Update to 7.1.14
- Medium6.5Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.1Update to 13.1.2