CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1322)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- Medium6.1Reflected Cross-Site Scripting
WPSOLR – Elasticsearch and Solr search
≤8.6Update to 8.7
- Medium6.4Cross-Site Scripting via Network Settings Page
WordPress
<4.5Update to 4.5
- Medium6.1Reflected Cross-Site Scripting
S3 Video Plugin
≤0.983No patch available
- Medium6.1Reflected Cross-Site Scripting
MiniMax – Page Layout Builder
≤1.9.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Pro
≤2.1.0Update to 2.2.0
- Medium6.1Reflected Cross-Site Scripting
MW Font Changer
<4.3Update to 4.3
- Medium6.1Reflected Cross-Site Scripting
Defa Online Image Protector Free Edition
≤3.4No patch available
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤4.3Update to 4.3.1
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.7Update to 4.0.7
- Medium6.1Reflected Cross-Site Scripting
Post Duplicator
≤2.16Update to 2.17
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.40Update to 1.3.40
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Lightbox Plus
≤2.7.2No patch available
- Medium6.1Cross-Site Scripting
WP Customer Reviews
<3.0.9Update to 3.0.9
- High7.2Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
<2.7Update to 2.7
- Medium6.1Cross-Site Scripting
ScoreMe
≤2016-04-01No patch available
- High7.5Directory Traversal
Zedna eBook download
<1.2Update to 1.2
- Medium6.1Unauthenticated Cross-Site Scripting
WP Favorite Posts
≤1.6.5Update to 1.6.6
- Medium6.1Cross-Site Scripting
Music Store – WordPress eCommerce
≤1.0.41Update to 1.0.43
- High7.5Local File Inclusion
IMDB Profile Widget
<1.0.9Update to 1.0.9
- High8.1Unauthenticated Local File Inclusion
Issuu Panel
<1.6.6No patch available
- High7.5Arbitrary File Download
Memphis Documents Library
≤3.1.5Update to 3.1.6
- Critical9.8Local File Inclusion
A/B Test for WordPress
≤1.0.7No patch available
- High8.8Cross-Site Request Forgery via wp_ajax_wp_compression_test
WordPress
<4.5Update to 4.5
- High8.8Cross-Site Request Forgery & Arbitrary File Upload
Beauty & Clean
≤1.0.8No patch available
- Medium6.1Cross-Site Scripting
Ocim MP3
all versionsNo patch available
- Medium6.1Reflected Cross-Site Scripting
Shibboleth
≤1.6Update to 1.7
- Medium6.1Reflected Cross-Site Scripting
Goodnews – Responsive WordPress News/Magazine | News / Editorial
≤5.11.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Forget About Shortcode Buttons
≤1.1.1Update to 1.1.2
- Critical9.8SQL Injection
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
≤1.1Update to 1.2