CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1269)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.0.20Update to 2.0.21
- Medium4.3Cross-Site Request Forgery Bypass
Defender Security – Malware Scanner, Login Security & Firewall
≤2.4.6Update to 2.4.6.1
- Medium4.3Cross-Site Request Forgery Bypass
WP Private Content Plus
≤3.1Update to 3.2
- Medium4.3Cross-Site Request Forgery Bypass
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤4.4.6Update to 4.4.7
- High8.8Cross-Site Request Forgery
Process Steps Template Designer
<1.3Update to 1.3
- Medium4.3Cross-Site Request Forgery Bypass
eCommerce Product Catalog
<3.0.18Update to 3.0.18
- Medium4.3Cross-Site Request Forgery Bypass
Process Steps Template Designer
≤1.2.1Update to 1.3
- Medium4.3Cross-Site Request Forgery Bypass
ElasticPress
≤3.5.3Update to 3.5.4
- Medium4.3Cross-Site Request Forgery Bypass
Abandoned Cart Lite for WooCommerce
≤5.8.5Update to 5.8.6
- Medium4.3Cross-Site Request Forgery Bypass
Custom Banners
≤3.2.2Update to 3.3
- Medium5.4Reflected Cross-Site Scripting
File Manager
<7.1Update to 7.1
- Medium6.1Reflected Cross-Site Scripting
NextGen Gallery Pro
≤3.1.9Update to 3.1.11
- High7.5API Key Disclosure
Web-Stat – Live Visitor Analytics
≤1.4.0Update to 1.4.1
- Medium6.4Cross-Site Scripting
Advanced Order Export For WooCommerce
≤3.1.7Update to 3.1.8
- Critical9.8Arbitrary File Creation
QuadMenu – Mega Menu
≤2.0.6Update to 2.0.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Testimonial Rotator
≤3.0.3No patch available
- High7.2Authenticated Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.5.9Update to 1.6.0
- Medium6.1Administrator Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.3Authenticated OAuth Connection Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34.1Update to 3.4.34.1
- Medium5.4Cross-Site Request Forgery to OAuth Service Disconnection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.9Authenticated Arbitrary File Download
Theme Editor
≤2.5Update to 2.6
- Medium6.1Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11
- High8.8Cross-Site Request Forgery to Setting Modification
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- Medium6.1Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.0Update to 2.0
- High8.84.0.3 - Authenticated Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
4.0 – <4.0.4Update to 4.0.4
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- Medium6.1Social Directory WordPress Theme <= 2.4.2 - Reflected Cross-Site Scripting
Wyzi - Social Directory WordPress Theme
≤2.4.2Update to 2.4.3
- High7.5Server-Side Request Forgery
Like Button Rating ♥ LikeBtn
<2.6.32Update to 2.6.32
- High8.8Cross-Site Request Forgery
Name Directory
≤1.17.4Update to 1.18