CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1264)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Captchinoo, admin login page protection with Google recaptcha
≤2.3Update to 2.4
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.11Update to 2.12
- High8.8Improper Authorization
WP Maintenance Mode & Site Under Construction
<1.5.2Update to 1.5.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Limit Login Attempts (Spam Protection)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Login as User or Customer — User Switching
<1.8Update to 1.8
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WooCommerce
<5.2.0Update to 5.2.0
- Medium6.1Reflected Cross-Site Scripting
Accordions
<2.2.30Update to 2.2.30
- Medium5.5Authenticated Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.29Update to 1.30
- High8.8Authenticated PHP Object Injection
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- High7.5Unauthenticated Arbitrary Nonce Generation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.5Authenticated Arbitrary Plugin Installation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.3Unprotected AJAX Actions
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Critical9.8Arbitrary File Upload
Kaswara Modern VC Addons
≤3.0.1No patch available
- Medium4.3Authenticated Arbitrary Post Deletion
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.14Update to 1.7.15
- Medium6.1Multiple Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.69Update to 1.5.69
- Medium6.1Reflected Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.4Update to 1.10.5
- Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.2.4Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting via tab Parameter
All 404 Redirect to Homepage
<1.21Update to 1.21
- High8.8Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
- Medium4.8Authenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.4Update to 7.1
- Medium6.1Reflected Cross-Site Scripting
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.4Stored Cross-Site Scripting
Clever Addons for Elementor
<2.1.0Update to 2.1.0
- Medium6.5Sensitive Information Disclosure
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- High7.1XXE Injection
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤4.1.9Update to 2.0.7 or 4.1.10
- High8.8Authenticated (Contributor+) Privilege Escalation
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤2.0.6Update to 2.0.7