CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1292)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
Converter for Media – Optimize images | Convert WebP & AVIF
≤1.0.2Update to 1.0.3
- Medium5.4Stored Cross-Site Scripting
WP Ultimate Recipe
<3.12.7Update to 3.12.7
- Medium5.4Authenticated Stored Cross-Site Scripting
WebP Express
<0.14.11Update to 0.14.11
- Medium6.1Cross-Site Scripting
Limb Gallery | Create Beautiful Image & Video Galleries
<1.4.0Update to 1.4.0
- Medium6.1Reflected Cross-Site Scripting
Custom 404 Pro
<3.2.9Update to 3.2.9
- Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.51Update to 2.0.52
- Medium5.7Cross-Site Request Forgery
Admin renamer extended
≤3.2.1No patch available
- High8.8Cross-Site Request Forgery
HTML5 Maps
≤1.6.5.6Update to 1.6.5.7
- Medium6.1Reflected Cross-Site Scripting
Custom 404 Pro
<3.2.8Update to 3.2.8
- High8.8Cross-site Request Forgery
Custom CSS Pro
≤1.0.3Update to 1.0.4
- Medium5.4Cross-Site Request Forgery and Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.51Update to 2.0.52
- Medium5.4Cross-Site Scripting
CP Contact Form with PayPal
<1.3.02Update to 1.3.02
- Medium6.1Cross-Site Scripting
CP Contact Form with PayPal
≤1.3.01Update to 1.3.02
- High8.8Cross-Site Request Forgery
Deny All Firewall
≤1.1.6Update to 1.1.7
- Medium6.3Cross-Site Request Forgery leading to attachment deletion & Path Traversal
Import and export users and customers
≤1.14.1.3Update to 1.14.2.2
- Medium6.5Authenticated Settings Reset via reset-cmb Parameter
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.27.1Update to 1.0.27.1
- High7.5Directory Traversal
Import and export users and customers
≤1.14.2.1Update to 1.14.2.2
- Medium6.1Cross-Site Scripting
Import and export users and customers
≤1.14.1.2Update to 1.14.1.3
- Critical9.8Local File Inclusion
Sina Extension for Elementor
<2.2.1Update to 2.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via track_link
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<2.1.10Update to 2.1.10
- High8.8Cross-Site Request Forgery
GoHero Store Customizer for WooCommerce
≤2.4Update to 2.5
- High8.8Cross-Site Request Forgery
Meta for WooCommerce
≤1.9.12Update to 1.9.15
- High8.8Cross-Site Request Forgery allowing Option Update
Meta for WooCommerce
≤1.9.12Update to 1.9.15
- Medium4.3Unauthorized Profile Modification
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Cross-Site Request Forgery
WP-Members Membership Plugin
≤3.2.7Update to 3.2.8.1
- Medium6.1Stored Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.9.16Update to 2.9.16
- High8.8Cross-Site Request Forgery
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤10.4.4Update to 10.4.5
- High8.8Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.2999Update to 4.2999
- High8.8Cross-site Request Forgery
Attendance Manager
≤0.5.6Update to 0.5.7