CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1257)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
Software License Manager
<4.4.6Update to 4.4.6
- Critical9.8Unauthenticated SQL Injection
Astra Pro Addon
<3.5.2Update to 3.5.2
- Medium6.4WP Upload Restriction <= 2.2.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Upload Restriction
≤2.2.4Update to 2.2.5
- High8.8Cross-Site Request Forgery
Email Template Designer – WP HTML Mail
<3.0.8Update to 3.0.8
- High8.8Cross-site request forgery
WPCS – WordPress Currency Switcher Professional
≤1.1.6Update to 1.1.7
- Medium6.1Reflected Cross-Site Scripting
Marmoset Viewer
<1.9.3Update to 1.9.3
- Medium5.4Simple Icons <= 2.7.7 - Authenticated Cross-Site Scripting
Popular Brand Icons – Simple Icons
<2.7.8Update to 2.7.8
- High7.2Authenticated (Admin+) Remote Code Execution
Speed Booster Pack ⚡ PageSpeed Optimization Suite
<4.2.0Update to 4.2.0
- Medium4.3Cross-Site Request Forgery Bypass
WP Easy Pay – Payment and Donation Form Builder for Square
≤3.2.0Update to 3.2.3
- Medium4.3Cross-Site Request Forgery Bypass
Vuukle – Comments, Reactions, Quizzes, Share Bar & Ad Revenue
≤3.4.31Update to 4.0
- Medium4.3Cross-Site Request Forgery Bypass
Slider Hero with Video Background, Animation
≤8.2.0Update to 8.2.1
- Medium4.3Cross-Site Request Forgery Bypass
Amministrazione Trasparente
≤7.1Update to 7.1.1
- Medium4.3Cross-Site Request Forgery Bypass
Locations
≤3.2.1Update to 4.0
- Medium6.1Reflected Cross-Site Scripting
CP Multi View Events Calendar
≤1.3.99Update to 1.4.01
- Medium4.3Cross-Site Request Forgery Bypass
Recarto – Abandoned Cart Recovery for WooCommerce
≤1.0.4Update to 1.0.4.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Popular Posts
≤5.3.3Update to 5.3.4
- High8.8Authenticated Blind SQL Injection
WooCommerce Blocks
≤5.5Update to 2.5.16 or 2.6.2 or 2.7.2 or 2.8.1 or 2.9.1 or 3.0.1 or 3.1.1 or 3.2.1 or 3.3.1 or 3.4.1 or 3.5.1 or 3.6.1 or 3.7.2 or 3.8.1 or 3.9.1 or 4.0.1 or 4.1.1 or 4.2.1 or 4.3.1 or 4.4.3 or 4.5.3 or 4.6.1 or 4.7.1 or 4.8.1 or 4.9.2 or 5.0.1 or 5.1.1 or 5.2.1 or 5.3.2 or 5.4.1 or 5.5.1
- Medium5.5Authenticated Stored Cross-Site Scripting
Forms
<1.12.3Update to 1.12.3
- Medium4.3Missing Authorization Checks
WP Upload Restriction
≤2.2.4Update to 2.2.5
- Medium4.3Missing Authorization Checks
WP Upload Restriction
≤2.2.4Update to 2.2.5
- High8.1Cross-Site Request Forgery
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- Medium6.1Reflected Cross-Site Scripting
Community Events
<1.4.8Update to 1.4.8
- Critical9.8Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- Medium6.4Contributor+ Stored Cross-Site Scripting
Leaflet Map
≤2.23.3Update to 3.0.0
- High8.8Arbitrary File Upload
PWA for WP – Progressive Web Apps Made Simple
≤1.7.32Update to 1.7.33
- Medium6.3Missing Authorization
PWA for WP – Progressive Web Apps Made Simple
≤1.7.32Update to 1.7.33
- Medium4.8Admin+ Stored Cross-Site Scripting
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.7.6Update to 1.7.7
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Leaflet Map
≤2.23.3Update to 3.0.0
- Medium5.5Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.0.7.1Update to 3.0.7.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.4.7Update to 3.4.8