CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 127)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Admin+) Arbitrary File Upload
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Remote Code Execution
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.15Update to 5.0.16
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium6.4Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
Bridge - Creative Multipurpose WordPress Theme
≤30.8.9.1Update to 30.8.9.2
- High7.2Unauthenticated Arbitrary HTML Injection in Notification Emails
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Medium5.3Unauthenticated Information Exposure
Bookit — Booking & Appointment Calendar
<2.6.0.1Update to 2.6.0.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.12Update to 4.7.12
- Medium5.3Missing Authorization
Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings
≤3.5.1Update to 3.5.2
- Medium5.35.2.7 - Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
5.0 – 5.2.7Update to 5.2.8
- Medium4.3Authenticated (Contributor+) Information Exposure
WP Directory Kit
≤1.6.0Update to 1.6.1
- Medium4.71.9.8 - Authenticated (Administrator+) Privilege Escalation
Temporary Login Without Password
1.5 – 1.9.8Update to 1.9.9
- Medium4.33.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.14.0 – 3.4.0Update to 3.4.1
- Medium5.3Unauthenticated Information Exposure
WP Directory Kit
<1.6.1Update to 1.6.1
- Medium4.3Missing Authorization
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More
<3.1.1Update to 3.1.1
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium4.9Authenticated (Editor+) SQL Injection
WP Directory Kit
≤1.5.8Update to 1.5.9
- Medium5.3Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
<8.5.7Update to 8.5.7
- Medium5.31.2.2 - Unauthenticated Insecure Direct Object Reference
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
1.0.9 – 1.2.2Update to 1.2.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
<20.8.16Update to 20.8.16
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Menu Wizard Widget
≤3.3.1No patch available
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
<3.4.1Update to 3.4.1
- Medium5.31.10.0 - Unauthenticated Information Exposure
SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph
1.6.2 – 1.10.0Update to 1.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Highlight Box
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium6.5Unauthenticated SQL Injection via URL Path
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.1Update to 4.2.2
- High7.5Unauthenticated Local File Inclusion
GEO my WP
≤4.5.5.3Update to 4.5.5.4
- High8.8Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
DT LMS – elearning, WordPress LMS Plugin
≤1.1Update to 1.2