CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1291)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
FV Flowplayer Video Player
≤7.3.18.727Update to 7.3.19.727
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
≤5.2Update to 5.3
- Medium6.3Unauthorized Settings Update
LoginPress | wp-login Custom Login Page Customizer
≤1.1.13Update to 1.1.14
- Medium6.5Information Exposure
WPGraphQL
≤0.3.4Update to 0.3.5
- Medium6.1Reflected Cross-Site Scripting
Gallery PhotoBlocks
<1.1.43Update to 1.1.43
- Medium6.4Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤1.10.28.2Update to 1.10.29
- Medium6.1Cross-Site Scripting
Appointment Hour Booking – Booking Calendar
<1.1.46Update to 1.1.46
- Medium6.1Reflected Cross-Site Scripting
Simple Link Directory – AI Powered
<7.3.5Update to 7.3.5
- Medium6.4Authenticated Stored Cross Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤11.5Update to 11.6-RC5
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<7.11.35Update to 7.11.35
- High7.2SQL Injection
Rencontre – Dating Site
<3.1.3Update to 3.1.3
- Medium4.8Cross-Site Scripting
Rencontre – Dating Site
<3.1.3Update to 3.1.3
- Medium5.3Missing Authorization
WP Like Button
<1.6.1Update to 1.6.1
- Medium6.1Cross-Site Scripting
Appointment Booking Calendar
<1.3.19Update to 1.3.19
- High8.8Cross-Site Request Forgery
Visitor Traffic Real Time Statistics
≤1.13Update to 1.14
- High7.5Unauthenticated Options update and CSS injection
Ocean Extra
≤1.5.8Update to 1.5.9
- Critical9.8SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<3.1.2Update to 3.1.2
- Medium6.1Reflected Cross-Site Scripting
Simple Mail Address Encoder
<1.7Update to 1.7
- High8.8Cross-Site Request Forgery
Visitor Traffic Real Time Statistics
≤1.12Update to 1.13
- Medium6.5Directory Traversal
Insert or Embed Articulate Content into WordPress
<4.29991Update to 4.29991
- High8.8Directory Traversal
Newsletters
<4.6.19Update to 4.6.19
- Medium5.4Cross-Site Scripting via contentarea Parameter
Newsletters
<4.6.19Update to 4.6.19
- High8.8SQL Injection
Server Status by Hostname/IP
≤4.6Update to 5.0
- Critical9.8Code Injection
Easy Forms for Mailchimp
<6.5.3Update to 6.5.3
- High8.8Cross-Site Request Forgery
Widget Logic
<5.10.2Update to 5.10.2
- Critical9.8Unauthenticated Blind SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.6.1Update to 12.6.7
- Medium6.1Cross-Site Scripting
Easy restaurant menu manager
≤1.1.2Update to 1.2
- High8.8Cross-Site Request Forgery
ACF: Better Search
<3.3.1Update to 3.3.1
- High8.8Cross-Site Request Forgery
WP Better Permalinks
<3.0.5Update to 3.0.5
- Medium6.1Reflected Cross-Site Scripting
360 Product Rotation
<1.4.8Update to 1.4.8