CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1318)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
CM Tooltip Glossary
<3.3.5Update to 3.3.5
- Medium6.1Reflected Cross-Site Scripting
Simpel Reserveren 3
≤3.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting via gid
PhotoXhibit
≤2.1.8No patch available
- Medium6.1Reflected Cross-Site Scripting
indexisto
≤1.0.5No patch available
- Medium6.1Reflected Cross-Site Scripting
WHIZZ
<1.0.8Update to 1.0.8
- Medium6.1Reflected Cross-Site Scripting via channel parameter
HDW WordPress Video Gallery
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Tidio Gallery
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting via playlist parameter
HDW WordPress Video Gallery
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
E-Search
≤1.0No patch available
- Critical9.8SQL Injection
Zotpress
<6.1.3Update to 6.1.3
- Medium6.1Cross-Site Scripting
WP Editor
<1.2.6.3Update to 1.2.6.3
- Medium5.0Server-Side Request Forgery
WordPress
<4.5Update to 4.5
- Medium6.1Cross-Site Scripting
Google Doc Embedder
<2.6.2Update to 2.6.2
- High8.8Cross-Site Request Forgery
Google Doc Embedder
≤2.6.1Update to 2.6.2
- Medium6.1Cross-Site Scripting
Google Doc Embedder
<2.6.1Update to 2.6.1
- High7.5Insecure Direct Object Reference
WP Support Plus Responsive Ticket System
<7.1.0Update to 7.1.0
- Critical9.8Multipurpose WordPress Theme | WordPress < 1.8 - Arbitrary File Upload
Neosense - Multipurpose WordPress Theme | WordPress
<1.8Update to 1.8
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Podlove Podcast Publisher
<2.3.16Update to 2.3.16
- High8.8Multiple Cross-Site Request Forgery
Simple Membership
≤3.3.2Update to 3.3.3
- Medium6.4Stored Cross-Site Scripting
WP Frontend Profile
≤0.2.1Update to 0.2.2
- Critical9.8Privilege Escalation
WP Frontend Profile
≤0.2.1Update to 0.2.2
- Medium6.5Authenticated Directory Traversal to Arbitrary File Access
WordPress
≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
- High8.8Cross-Site Request Forgery
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<1.7.9Update to 1.7.9
- Medium4.8Authenticated Stored Cross-Site Scripting
WordPress
≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
- Medium6.1Reflected Cross-Site Scripting
Infusionsoft Gravity Forms Add-on
<1.5.12Update to 1.5.12
- Critical9.8Arbitrary File Upload/Read
CYSTEME Finder, the admin files explorer
<1.4Update to 1.4
- Critical9.8Local File Inclusion
Mail Masta
≤1.0No patch available
- Medium6.1Multipurpose WordPress Theme (All Versions) - Reflected Cross-Site Scripting
Akal - Multipurpose WordPress Theme
all versionsNo patch available
- Medium6.5Denial of Service
WordPress
<4.6Update to 4.6
- Medium5.5Cross-Site Scripting
CampTix Event Ticketing
<1.5Update to 1.5