CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1251)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Cross-Site Request Forgery
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤3.4.1Update to 3.4.2
- High8.8Cross-Site Request Forgery
Fileviewer
≤2.2No patch available
- Medium6.5Gutenberg Blocks for Post Grid <= 2.4.9 - Unauthorized Access Controls
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium4.8Authenticated Stored Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤2.0.2Update to 2.0.3
- Medium6.1Reflected Cross-Site Scripting
MF Gig Calendar
≤1.1Update to 1.2
- Critical9.8Unauthenticated Arbitrary File Upload
Shopp
≤1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
SP Project & Document Manager
≤4.25Update to 4.26
- Medium6.45.0.3 - Stored Cross-Site Scripting
SEOPress – AI SEO Plugin & On-site SEO
≤5.0.3Update to 5.0.4
- High7.2Arbitrary File Upload
Email Artillery (MASS EMAIL)
≤4.1No patch available
- Medium4.3Cross-Site Request Forgery Bypass
WP Security Question
≤1.0.5No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Opal Estate
≤1.6.11No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
<2.19.2Update to 2.19.2
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
<2.0.44Update to 2.0.44
- Medium4.3Cross-Site Request Forgery Bypass
Rucy
≤0.4.4No patch available
- Medium4.3Missing Authorization
Opal Estate
≤1.6.11No patch available
- Critical9.8Multifactor Bypass
WP Cerber Security, Anti-spam & Malware Scan
<8.9.3Update to 8.9.3
- Medium4.3Cross-Site Request Forgery Bypass
Event Espresso – Event Registration & Ticketing Sales
≤4.10.11Update to 4.10.12
- Medium4.3Cross-Site Request Forgery Bypass
Etsy Integration For WooCommerce
≤3.3.1Update to 3.3.2
- High8.8Cross-Site Request Forgery
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
≤3.1.2No patch available
- Medium4.3Cross-Site Request Forgery Bypass
WP-Backgrounds Lite
≤2.3No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Sell Media
≤2.5.5Update to 2.5.6
- Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
Language Bar Flags
≤1.0.8Update to 1.1.0
- Medium4.3Cross-Site Request Forgery Bypass
RAYS Grid
≤1.2.2Update to 1.3.0
- Medium5.3Access Bypass Control
WP Cerber Security, Anti-spam & Malware Scan
<8.9.3Update to 8.9.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Advanced Ticket System, Elite Support Helpdesk
<1.0.64Update to 1.0.64
- Medium6.1Reflected Cross-Site Scripting
Calendar_plugin
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Plugmatter Pricing Table Lite
≤1.0.32No patch available
- Medium6.1Reflected Cross-Site Scripting
Moova
≤3.5Update to 3.6
- Medium6.1Reflected Cross-Site Scripting
Custom Post Type Relations
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Behance Portfolio
≤0.2No patch available