CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1249)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated Stored Cross-Site Scripting
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
<2.0.2Update to 2.0.2
- Critical9.8Multiple Unauthenticated SQL Injections
Support Board
≤3.3.3Update to 3.3.4
- Medium6.4Authenticated (admin+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.1.1.2Update to 2.1.1.3
- Medium6.5Contributor+ Arbitrary File Download
Simple Download Monitor
<3.9.5Update to 3.9.5
- High8.1SQL Injection
Meow Gallery
<4.1.9Update to 4.1.9
- Medium6.1Easy Social Icons <= 3.0.8 – Reflected Cross-Site Scripting
Easy Social Icons
≤3.0.8Update to 3.0.9
- Medium5.3Missing Authorization to Sensitive Information Disclosure
Redux Framework
≤4.2.11Update to 4.2.13
- Medium6.4Cross-Site Scripting
Zoho CRM Lead Magnet
≤1.7.2.4Update to 1.7.2.9
- High7.1Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion
Redux Framework
≤4.2.12Update to 4.2.13
- Medium5.3Unauthenticated Settings Import/Export
WooCommerce Dynamic Pricing and Discounts
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
underConstruction
≤1.18Update to 1.19
- Medium6.5Stored Cross-Site Scripting
WooCommerce Dynamic Pricing and Discounts
<2.4.2Update to 2.4.2
- Medium6.5Authenticated (Subscriber+) Limited Arbitrary Option Update
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.5.1Update to 4.5.2
- High7.5WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal
ZoomSounds - WordPress Wave Audio Player with Playlist
≤6.45Update to 6.50
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA
<2.1.2Update to 2.1.2
- Medium4.3Missing Authorization
Countdown Block
<1.1.2Update to 1.1.2
- Medium4.8Authenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
<2.0.9Update to 2.0.9
- Medium5.4Authenticated Stored Cross-Site Scripting
CoolClock
<4.3.5Update to 4.3.5
- Medium5.5Duplicate Page <= 4.4.1 Authenticated (Admin+) Stored Cross-Site Scripting
Duplicate Page
≤4.4.1Update to 4.4.2
- Medium5.4Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium4.3Private Content Disclosure
Post Grid Gutenberg Blocks – PostX
≤2.4.9Update to 2.4.10
- Medium5.4Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium5.4Stored Cross-Site Scripting
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
<1.2.3Update to 1.2.3
- Medium6.4Contributor+ Cross-Site Scripting
MX Time Zone Clocks
<3.4.1Update to 3.4.1
- Medium6.4Authenticated (Author) Stored Cross-Site Scripting
Real Media Library: Media Library Folder & File Manager
≤4.14.1Update to 4.14.2
- High8.1Cross-Site Request Forgery to Arbitrary Post Deletion and Modification
Nested Pages
≤3.1.15Update to 3.1.16
- Medium4.7Open Redirect
Nested Pages
≤3.1.15Update to 3.1.16
- Critical9.8Authentication Bypass
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.4.3Update to 5.4.4
- Medium6.1Reflected Cross-Site Scripting
Recipe Card Blocks Lite
<2.8.1Update to 2.8.1
- Critical9.8Unauthenticated SQL Injection
Podlove Podcast Publisher
<3.5.6Update to 3.5.6