CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 128)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection via 'compare' Parameter
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.11Update to 4.7.12
- Medium6.5Authenticated (Subscriber+) SQL Injection via Parameter Name
Smart Marketing SMS and Newsletters Forms
≤5.1.24Update to 5.1.25
- Critical9.8Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
The Events Calendar
≤6.17.3Update to 6.17.3.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
The Events Calendar
≤6.17.4Update to 6.17.4.1
- Medium4.3Missing Authorization
Simple Membership
<4.7.8Update to 4.7.8
- Medium5.33.0.17 - Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
3.0.10 – 3.0.17Update to 3.0.18
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- Medium4.3Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition
Quads Ads Manager for Google AdSense
3.0.4 – 3.0.4Update to 3.0.5
- Medium4.3Authenticated (Subscriber+) Information Exposure
SSL Zen — SSL Certificate Installer & HTTPS Redirects
<4.7.40Update to 4.7.40
- Medium5.3Missing Authorization
YITH WooCommerce Wishlist
<4.18.1Update to 4.18.1
- Medium5.30.9.3 - Unauthenticated Payment Bypass
Payment Gateway PayPay for WooCommerce
0.5 – 0.9.3No patch available
- Medium5.37.6.2 - Unauthenticated Insecure Direct Object Reference
Nexi XPay Build
7.6.1 – 7.6.2No patch available
- High8.1Unauthenticated PHP Object Injection
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Simple Payment
≤2.5.4Update to 2.5.6
- Medium5.3Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Medium5.3Unauthenticated Information Exposure
bbPress
≤2.6.14Update to 2.6.15
- High8.18.2.2 - Unauthenticated PHP Object Injection
Site Reviews
7.2.2 – 8.2.2Update to 8.3.0
- Medium6.35.0.15 - Authenticated (Custom Role+) Privilege Escalation
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
5.0.0 – 5.0.15Update to 5.0.16
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.10.0Update to 4.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.9.9Update to 5.9.10
- Medium4.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
Booking for Appointments and Events Calendar – Amelia
≤2.4.9Update to 2.4.10
- Medium5.3Missing Authorization
MDJM Event Management
<1.7.8.5Update to 1.7.8.5
- Medium4.34.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Visualizer – Tables & Charts Manager with Built-in AI Generator
4.0.0 – 4.0.5Update to 4.0.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Gato GraphQL
≤19.2.3Update to 19.2.4
- Medium5.3Missing Authorization
zipMoney(Zip Co) Payments Plugin for WooCommerce
<2.4.0Update to 2.4.0
- Medium4.35.7.4 - Missing Authorization
BackWPup – WordPress Backup & Restore Plugin
5.2.2 – 5.7.4Update to 5.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Featured Image with URL
<1.0.6Update to 1.0.6
- Medium6.42.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
AI Builder – Generate pages, blocks, images & translate with AI
2.4.1 – 2.7.7Update to 2.7.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Gutenverse News – News Blocks for Blog & Magazine Sites
<3.3.3Update to 3.3.3