CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1319)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
WordPress
<4.6Update to 4.6
- Medium4.3Authorization Bypass
WordPress
<4.6Update to 4.6
- High8.8Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
<1.8.6Update to 1.8.6
- Medium6.1Cross-Site Scripting
LoginWP (Formerly Peter's Login Redirect)
<2.9.1Update to 2.9.1
- High8.8Cross-Site Request Forgery
Add From Server
<3.3.2Update to 3.3.2
- Medium6.1Reflected Cross-Site Scripting
FormBuilder
≤1.05Update to 1.06
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.3Update to 4.3.3
- Medium6.1Reflected Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
<2.3.2Update to 2.3.3
- Medium6.1Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
<2.3.3Update to 2.3.3
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.3Update to 4.3.3
- High8.8Remote Code Execution
wsecure lite
<2.4Update to 2.4
- Medium5.4Authenticated Stored Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
<3.4.1Update to 3.4.1
- Medium6.1Cross-Site Scripting
Uji Countdown
≤2.0.6Update to 2.0.7
- Critical9.8Unauthenticated Arbitrary File Upload
Estatik Real Estate Plugin
≤2.3.0Update to 2.3.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤6.2.03Update to 6.2.04
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Estatik Real Estate Plugin
≤2.3.0Update to 2.3.1
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.1Update to 4.3.1
- Medium6.1Cross-Site Scripting
WP-Polls
≤2.73Update to 2.73.1
- Medium6.1Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<3.1.2Update to 3.1.2
- Medium6.1Cross-Site Scripting
Total Security
<3.4.1Update to 3.4.1
- Medium5.3Unauthenticated Settings Change
Total Security
≤3.4.0Update to 3.4.1
- Medium6.1Reflected Cross-Site Scripting
WP Mail
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Nofollow Links
≤1.0.10Update to 1.0.11
- Medium6.1Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
- High8.8Cross-Site Request Forgery
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
- Medium6.1Cross-Site Scripting
dwnldr
≤1.0Update to 1.01
- Critical9.8Arbitrary File Upload
Frontend File Manager Plugin
<4.0Update to 4.0
- Medium5.8CSV Injection
CampTix Event Ticketing
<1.5Update to 1.5
- Medium6.1Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.4.2Update to 2.4.2
- Critical9.8SQL Injection
Photo Gallery by Ays – Responsive Image Gallery
<1.0.1Update to 1.0.1