CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1274)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Improper Access Controls
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤2.0.28Update to 2.0.29
- Medium4.3Cross-Site Request Forgery Bypass
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.5.16Update to 1.5.16
- Medium4.3Cross-Site Request Forgery Bypass
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.6.4Update to 1.6.4
- Medium4.3Cross-Site Request Forgery Bypass
Customizr
≤4.3.0Update to 4.3.1
- Medium4.3Cross-Site Request Forgery Bypass
Ocean Extra
<1.6.6Update to 1.6.6
- Medium4.3Cross-Site Request Forgery Bypass
Hueman
≤3.6.3Update to 3.6.4
- Critical9.8Arbitrary File Upload
Simple:Press Forum
<6.6.1Update to 6.6.1
- Critical9.8SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.2Update to 2.3.3
- High8.8Cross-Site Request Forgery to Plugin Installation
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- High7.5Insecure Cryptography to Sensitive Information Disclosure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- Medium6.1Cross-Site Scripting
UpdraftPlus Premium
<1.9.64Update to 1.9.64
- Medium5.3Validation Bypass via Email Field
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- Critical9.8SQL Injection
Advanced Contact form 7 DB
≤1.6.2Update to 1.7.0
- High7.5Sensitive Information Exposure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- High7.5Password Hash Extraction
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- Medium6.1Reflected Cross-Site Scripting
15Zine | Magazine Newspaper Blog News WordPress Theme
<3.3.0Update to 3.3.0
- Medium6.5Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27.1Update to 3.4.28
- High7.5Object Injection
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Stored Cross-Site Scripting
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Stored Cross-Site Scripting
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Object Injection
Team Showcase
<1.22.16Update to 1.22.16
- Medium4.3Cross-Site Request Forgery Bypass
Cool Timeline (Horizontal & Vertical Timeline)
<2.0.3Update to 2.0.3
- Medium4.3Cross-Site Request Forgery Bypass
Radio Buttons for Taxonomies
<2.0.6Update to 2.0.6
- Medium4.3Cross-Site Request Forgery Bypass
Import / Export Customizer Settings
<1.0.4Update to 1.0.4
- Medium4.3Cross-Site Request Forgery Bypass
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
<2.8.7Update to 2.8.7
- Medium4.3Cross-Site Request Forgery Bypass
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<3.5.8Update to 3.5.8
- Medium4.3Cross-Site Request Forgery Bypass
Easy Testimonials
<3.7Update to 3.7
- Medium4.3Cross-Site Request Forgery Bypass
Lightweight Sidebar Manager
≤1.1.4Update to 1.1.5
- Medium4.3Cross-Site Request Forgery Bypass
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<3.0.9Update to 3.0.9
- Medium4.3Cross-Site Request Forgery Bypass
Coupon Creator
<3.1.1Update to 3.1.1