CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1265)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
fitness calculators
≤1.9.5Update to 1.9.6
- Medium5.4Authenticated Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
<2.0.6Update to 2.0.6
- Medium5.4Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
<1.11.2Update to 1.11.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤2.1.7Update to 2.2.0
- Medium5.4Authenticated Stored Cross-Site Scripting
DethemeKit for Elementor
<1.5.5.5Update to 1.5.5.5
- High8.3Server-Side Request Forgery
Video Downloader for TikTok
<1.4Update to 1.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.3.1Update to 2.3.2
- Medium6.5Server-Side Request Forgery
Podcast Importer SecondLine
<1.1.5Update to 1.1.5
- Medium6.4WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting
WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates
<2.3.10Update to 2.3.10
- High8.1Directory Traversal to Arbitrary File Deletion and Denial of Service
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Medium5.3Server-Side Request Forgery
WP-DownloadManager
<1.68.5Update to 1.68.5
- Medium6.4Stored Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
<1.5.8Update to 1.5.8
- Medium5.4Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤1.5.5Update to 1.5.7
- Medium5.4Stored Cross-Site Scripting
Ultimate Addons for Elementor
<1.30.0Update to 1.30.0
- Medium5.4Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤6.7.1Update to 6.8
- Medium6.1Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Medium5.4Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<4.5.4Update to 4.5.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Hover Effects – Elementor Addon
<1.3.4Update to 1.3.4
- Critical9.1Server-Side Request Forgery
Import XML and RSS Feeds
<2.0.3Update to 2.0.3
- High7.5Directory Traversal
Video Downloader for TikTok
<1.4Update to 1.4
- High8.6Directory Traversal
Media File Organizer
≤1.0.1No patch available
- Medium5.4Stored Cross-Site Scripting
Sina Extension for Elementor
<3.3.12Update to 3.3.12
- Medium6.4Authenticated Stored Cross-Site Scripting
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
<1.8.6Update to 1.8.6
- Critical9.1Server-Side Request Forgery
WP Smart Import : Import any XML File to WordPress
<1.0.1Update to 1.0.1
- Medium5.4Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
<4.2.8Update to 4.2.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
JetWidgets For Elementor
<1.0.9Update to 1.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rife Extensions & Templates for Elementor
<1.1.6Update to 1.1.6
- Medium6.5Cross-Site Request Forgery to Stored Cross-Site Scripting
Content Copy Protection & Prevent Image Save
≤1.3No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Super Cache
<1.7.3Update to 1.7.3
- Medium4.3Cross-Site Request Forgery to Arbitrary Payment History Update
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2