CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1259)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Reflected Cross-Site Scripting via extension
W3 Total Cache
0.5 – 2.1.4Update to 2.1.5
- Medium6.1Reflected Cross-Site Scripting
event-espresso-core
≤4.10.6.pUpdate to 4.10.7.p
- Critical9.8Unauthenticated Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
≤5.96Update to 6.05
- Medium6.4Authenticated Cross-Site Scripting
WP Popular Posts
<5.3.3Update to 5.3.3
- Medium5.3Local File Inclusion
WP Image Zoom
≤1.46Update to 1.47.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CiviCRM for WordPress
≤5.28.0Update to 5.28.1
- Critical9.8Unauthenticated Blind SQL Injection
Poll, Survey, Questionnaire and Voting system
<1.5.3Update to 1.5.3
- High7.1Cross-Site Scripting
Fudousan Plugin
≤5.7.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Prismatic
≤2.7Update to 2.8
- Medium4.3Cross-Site Request Forgery Bypass
Contact Form 7 Style
≤3.2No patch available
- Medium6.1Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
<6.3.1Update to 6.3.1
- High8.0Authenticated CSV Injection
Sign-up Sheets
<1.0.14Update to 1.0.14
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Glass
≤1.3.2No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Ultimate Gift Cards for WooCommerce
≤2.1.1Update to 2.1.2
- Medium5.4Stored Cross-Site Scripting
Prismatic
≤2.7Update to 2.8
- Medium4.8Stored Cross-Site Scripting
Sign-up Sheets
<1.0.14Update to 1.0.14
- Medium4.3Cross-Site Request Forgery Bypass
Absolute Reviews
≤1.0.8Update to 1.0.9
- Medium4.3Cross-Site Request Forgery Bypass
DW Question & Answer
≤1.5.8No patch available
- Medium5.4Stored Cross-Site Scripting
Browser Screenshots
<1.7.6Update to 1.7.6
- Medium4.3Cross-Site Request Forgery Bypass
wp-mpdf
≤3.5.1Update to 3.5.2
- Medium4.3Cross-Site Request Forgery Bypass
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.8.28Update to 2.8.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
simple sort&search
≤0.0.3No patch available
- Medium5.4Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting
Admin Columns
<4.3.2Update to 4.3.2
- High7.2Authenticated (Admin+) SQL Injection
Export Users With Meta
<0.6.5Update to 0.6.5
- Medium4.8Authenticated Stored Cross-Site Scripting
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)
<2.5.2Update to 2.5.2
- Medium4.3Cross-Site Request Forgery Bypass
Staff Directory Plugin: Company Directory
≤3.6Update to 4.0
- Medium4.3Cross-Site Request Forgery Bypass
Remove Schema
≤1.5Update to 1.6
- Medium6.4Missing Authorization to Redirect Creation
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
≤3.0.7Update to 3.0.8
- Medium6.1Unauthenticated Stored Cross-Site Scripting
YOP Poll
≤6.2.7Update to 6.2.8
- High8.8Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
<3.6.67Update to 3.6.67