VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 13)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,172 results

WordPress PHP Object Injection vulnerabilities (page 13)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter
LearnPress – Course Review≤4.2.2Update to 4.2.3
CVE-2026-118054—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes≤10.3.2Update to 11.0.0
CVE-2026-119098—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint
MotoPress Appointment Booking≤2.4.8Update to 2.4.9
CVE-2026-120741—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Email Field
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.6Update to 5.7.7
CVE-2026-119152—
Medium5.3Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter
Jupiter X Core≤4.62.0Update to 4.63.0
CVE-2026-120555—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review
Kubio AI Page Builder≤2.9.4Update to 2.9.5
CVE-2026-115816—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name
WPBakery Page Builder≤9.0.1Update to 9.1
CVE-2026-119165—
Medium5.9Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter
Jupiter X Core≤4.62.0Update to 4.63.0
CVE-2026-120737—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta
Jupiter X Core≤4.62.0Update to 4.63.0
CVE-2026-119219—
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title
JS Help Desk – AI-Powered Support & Ticketing System≤5.0.2Update to 5.0.3
CVE-2026-118046—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.6Update to 3.13.7
CVE-2026-120540—
High8.8Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json
Interactive Real Estate – Floor Plan & Building Visualizer≤2.6.0Update to 2.6.1
CVE-2026-104913—
Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix
Greenshift – animation and page builder blocks≤13.2.2Update to 13.2.3
CVE-2026-119218—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter
Social Slider Feed – Social Media Feed & Gallery Widgets≤2.3.8Update to 2.3.9
CVE-2026-121519—
Medium5.3Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter
Greenshift – animation and page builder blocks≤13.2.2Update to 13.2.3
CVE-2026-120520—
High7.2Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.200Update to 2.8.201
CVE-2026-120082—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content
FV Flowplayer Video Player≤7.5.56.7212Update to 7.5.57.7212
CVE-2026-121515—
Medium5.4Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.50Update to 1.15.51
CVE-2026-118067—
Low3.7Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed
Fluent Support – Helpdesk & Customer Support Ticket System≤2.4.7Update to 2.5.0
CVE-2026-119213—
High7.2Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.50Update to 1.15.51
CVE-2026-120512—
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred≤4.0.2Update to 4.0.3
CVE-2026-123471—
High7.2Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter
VikBooking Hotel Booking Engine & PMS≤1.8.17Update to 1.8.18
CVE-2026-93429—
Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )≤9.12.2Update to 9.12.3
CVE-2026-118056—
Medium5.3Missing Authorization
Advanced Appointment Booking & Scheduling≤2.6Update to 2.7
CVE-2026-81422—
Critical9.8Unauthenticated Arbitrary File Upload
WP Duplicate – WordPress Migration Plugin≤1.1.11No patch available
CVE-2026-123751—
Medium4.3Missing Authorization
GemBooking – Appointment Booking, Booking Calendar & Reservations≤1.7.0Update to 1.7.1
CVE-2026-123131—
Medium5.3Unauthenticated Team Member Double-Booking
GemBooking – Appointment Booking, Booking Calendar & Reservations≤1.7.0Update to 1.7.1
CVE-2026-123128—
Medium4.3Two-Factor Authentication Bypass
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…≤2.10.0Update to 2.11.0
CVE-2026-123091—
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Fusion Page Builder≤1.7.0Update to 1.7.1
CVE-2026-121759—
Medium4.3Missing Authorization
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes≤4.2.0Update to 4.3.1
CVE-2026-120851—

Search VulnCrest Radar

Jump to

Are you sure?