CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1349)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
≤2.5Update to 2.6
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Critical9.8SQL Injection
Yoast Duplicate Post
≤2.5Update to 2.6
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- High7.1Cross-Site Scripting
WP Symposium
<13.04Update to 13.04
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- Medium6.1Cross-Site Scripting
Adminimize
≤1.7.21Update to 1.7.22
- Critical9.8Arbitrary File Upload
WordPress Font Uploader
≤1.3Update to 1.3.1
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤0.4.4Update to 0.4.5
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- Medium6.1Multiple Cross-Site Scripting
WP Super Cache
≤1.3Update to 1.3.1
- Medium6.1DOM Cross-Site Scripting
Image Slider
<1.1.7Update to 1.1.7
- Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories
≤1.1.1No patch available
- Medium6.1Cross-Site Scripting
Events Manager Pro
<2.2.9Update to 2.2.9
- High8.8Cross-Site Request Forgery
WP Activity Log
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
wp-media-player
≤0.8No patch available
- Medium6.3Cross-Site Request Forgery
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- High7.3Unspecified Vulnerability
Image News Slider
≤3.2Update to 3.3
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.3.9Update to 5.3.9
- High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Quick Page/Post Redirect Plugin
<5.0.5Update to 5.0.5
- Critical9.9Authenticated SQL Injection
BSK PDF Manager
<1.5Update to 1.5
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.3Information Disclosure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.0.2Update to 2.0.2