CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1298)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤0.9.97.20Update to 0.9.97.21
- Medium6.1Cross-Site Scripting via begin_date, end_date, or form_id Parameter
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.3.18Update to 3.3.18
- Medium5.4Authenticated Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.7.0Update to 3.7.5
- High7.5Directory Traversal
Media from FTP
<9.85Update to 9.85
- Medium5.4Stored Cross-Site Scripting
Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs
≤1.8.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- High8.8Cross-Site Request Forgery
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- High8.8Cross-Site Request Forgery
Read and Understood
<2.2Update to 2.2
- Medium5.4Stored Cross-Site Scripting
Easy Custom Auto Excerpt
<2.4.7Update to 2.4.7
- Medium6.1Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Critical9.8SQL Injection
BuddyForms
≤2.2.7Update to 2.2.8
- Medium6.1Open Redirect
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- High7.2Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Critical9.8Arbitrary Options Update and Action Calling
Cookie Information | Free GDPR Consent Solution
<1.4.3Update to 1.4.3
- Critical9.8SQL Injection
RSVPMaker
<5.6.4Update to 5.6.4
- Medium6.6Race Condition to Remote Code Execution
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤9.1.0Update to 9.2.0
- High7.2WooCommerce File Deletion
WooCommerce
<3.4.6Update to 3.4.6
- Medium6.1Reflected Cross-Site Scripting
Media File Manager
≤1.4.2Update to 1.4.3
- Medium5.4Cross-Site Scripting
Event Calendar WD version
≤1.1.21Update to 1.1.22
- Critical9.8Arbitrary File Upload
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
≤1.4.13Update to 1.4.14
- Medium4.8Cross-Site Scripting
WP Editor.md – The Perfect WordPress Markdown Editor
<10.0.4Update to 10.0.4
- Medium5.4Authenticated Stored Cross-Site Scripting
Calendar
<1.3.11Update to 1.3.11
- Medium6.1Cross-Site Scripting
Elementor Website Builder Pro
<2.0.10Update to 2.0.10
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal
ARforms
<3.5.2Update to 3.5.2
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.15Update to 8.0.16
- Critical9.8Arbitrary File Upload
Arigato Autoresponder and Newsletter
all versionsNo patch available
- Medium6.4Cross-Site Scripting
Support Board
<1.2.4Update to 1.2.4
- Critical9.8Arbitrary File Upload
Tajer
≤1.0.5No patch available
- High8.8Cross-Site Request Forgery via page to wpfastestcacheoptions
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6
- Medium6.1Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6