CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1326)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
Support Ticket System
<1.2.1Update to 1.2.1
- Medium6.1Reflected Cross-Site Scripting
Easy2Map
≤1.2.9Update to 1.3.0
- Critical9.8Directory Traversal and Local File Inclusion
Easy2Map
≤1.2.9Update to 1.3.0
- Medium6.12.7.9 - Unauthenticated DOM Cross-Site Scripting
uDesign - Responsive WordPress Theme
2.3.0 – 2.7.9Update to 2.7.10
- Medium6.1Reflected Cross-Site Scripting
Payment Form for PayPal Pro
<1.0.2Update to 1.0.2
- Medium6.1Reflected Cross-Site Scripting
ResAds
<1.0.2Update to 1.0.2
- Medium6.1Cross-Site Scripting
Quotes and Tips by BestWebSoft
<1.20Update to 1.20
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft
<1.0.8Update to 1.0.8
- High7.5Directory Traversal to Unauthenticated Arbitrary File Read
mTheme-Unus
<2.3Update to 2.3
- High8.8Unauthenticated Remote Command Execution
WordPress Landing Pages
<1.9.2Update to 1.9.2
- Medium6.1Multiple Reflected Cross-Site Scripting
Appointment Booking Calendar
≤1.1.7Update to 1.1.8
- Critical9.8SQL Injection
Appointment Booking Calendar
≤1.1.7Update to 1.1.8
- Medium6.1Cross-Site Scripting
xPinner Lite
≤2.2No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
ALO EasyMail Newsletter
<2.6.01Update to 2.6.01
- Critical9.8SQL Injection
CP Reservation Calendar
<1.1.7Update to 1.1.7
- Medium6.4Cross-Site Scripting via Shortcodes
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Medium6.4Authenticated Cross-Site Scripting
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Medium5.4Authorization Bypass to Information Disclosure
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Critical9.8Local File Inclusion
mypixs
≤0.3No patch available
- High8.8Cross-Site Request Forgery
xPinner Lite
≤2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤6.0.4Update to 6.0.5
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.15Update to 2.1.23
- High7.5Path Traversal
estrutura-basica
all versionsNo patch available
- Medium6.1Cross-Site Scripting
RoyalSlider
<3.2.7Update to 3.2.7
- Medium6.1Cross-Site Scripting
Replyable – Subscribe to Comments and Reply by Email
<1.4.6Update to 1.4.6
- Medium6.5Cross-Site Forgery Request and Reflected Cross-Site Scripting
eShop
≤6.3.13Update to 6.3.14
- Medium6.1Cross-Site Scripting
Fast Secure Contact Form
≤4.0.37Update to 4.0.38
- Medium6.1Reflected Cross-Site Scripting
WP Symposium
≤15.8.1Update to 15.9
- Medium6.1Cross-Site Scripting
Gallery – Photo Albums Plugin
<1.3.50Update to 1.3.50
- Medium6.6PHP Object Injection
SecureMoz Security Audit
≤1.0.5No patch available