CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1282)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Missing Authorization
WP Activity Log
<4.0.2Update to 4.0.2
- Critical9.1Unauthenticated Database Wiping
Custom Searchable Data Entry System
≤1.7.1No patch available
- Critical9.9Authenticated Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Medium4.3Authenticated Email Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Settings and User Data Export
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- High8.0Cross-Site Request Forgery to Settings Modification
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Settings Import to Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium5.3Unauthenticated Coupon Creation
WooCommerce Smart Coupons
<4.6.5Update to 4.6.5
- Critical9.1Unprotected AJAX Actions
Responsive Starter Templates – Elementor Templates & Starter Sites
<2.2.6Update to 2.2.7
- High7.8CSV Injection
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- Medium4.8Stored Cross-Site Scripting
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- High7.5VulnCrest analysisKEVPoCDirectory Traversal
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<1.3.28Update to 1.3.28
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Async JavaScript
<2.20.02.27Update to 2.20.02.27
- Medium5.4Missing Authorization to Stored Cross-Site Scripting and Settings Update
Modern Events Calendar Lite
<5.1.7Update to 5.1.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change
10Web Map Builder for Google Maps
<1.0.64Update to 1.0.64
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP Job Board
≤5.5.3Update to 5.6.0
- Medium6.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.2Update to 2.9.3
- High7.2Unauthenticated Arbitrary Plugin Settings Update
Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager
<2.3.2Update to 2.3.2
- High8.8Cross-Site Request Forgery to Cross-Site Scripting and Setting Changes
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Premium
≤2.2.2Update to 2.2.3
- High7.3Missing Authorization on AJAX Actions
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
<1.7.7Update to 1.7.7
- Medium5.5Multiple Cross-Site Scripting Issues
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.45Update to 1.5.46
- High8.1Lack of Origin Validation
CardGate Payments for WooCommerce
<3.1.16Update to 3.1.16
- Medium6.4Authenticated Stored Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
<2.2.5Update to 2.2.5
- Medium6.4Stored Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
<1.5.9Update to 1.5.9
- High8.8Cross-Site Request Forgery
Easy Property Listings
<3.4Update to 3.4
- Critical9.8Improper Access Control to Privilege Escalation
wpCentral
≤1.5.0Update to 1.5.1
- Critical9.82.6.7.6 - PHP Object Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
2.2.8 – 2.6.7.6Update to 3.0