CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 138)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Unauthorized B2B Group Assignment
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
<5.2.40Update to 5.2.40
- Medium6.53.3.9.1 - Authenticated (Author+) Arbitrary File Read
Pods – Custom Content Types and Fields
3.3 – 3.3.9.1Update to 3.3.9.2
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
Custom Contact Forms
≤7.16Update to 7.16.1
- Medium5.4Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.3.3Update to 7.3.4
- Medium4.3Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
Ninja Forms - Save Progress
≤3.0.30Update to 3.0.31
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Abandoned Cart Pro for WooCommerce
≤10.7.1Update to 10.7.2
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.60Update to 2.1.70
- High8.8Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
Nokri – Job Board WordPress Theme
≤1.6.4Update to 1.6.6
- Medium4.3Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
WP Rentals - Booking Accommodation WordPress Theme
<3.16.0Update to 3.16.0
- Medium5.3Missing Authorization
JetPopup
≤2.0.20.2Update to 2.0.20.3
- Medium6.53.15.1 - Unauthenticated Arbitrary Shortcode Execution
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
3.14.10 – 3.15.1Update to 3.15.2
- Critical9.8Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Divi Ajax Filter
≤5.1.2Update to 5.1.3
- High8.1Unauthenticated PHP Object Injection
JobSearch WP Job Board
≤3.2.0No patch available
- High7.5Unauthenticated Arbitrary File Read
Shared Files Pro
<1.7.70Update to 1.7.70
- High7.2Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
enfold
≤8.0Update to 8.1
- Medium5.34.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
EmbedPress
4.6.0 – 4.6.3Update to 4.6.4
- Medium5.3Unauthenticated Email Header Injection
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Critical9.8Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
SEOPress – AI SEO Plugin & On-site SEO
≤10.1Update to 10.2
- High8.1Unauthenticated PHP Object Injection
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium5.3Missing Authorization
Pre-Orders for WooCommerce
≤2.3.1Update to 2.3.2
- Medium6.1Unauthenticated Open Redirect
Accept Stripe Payments
<2.1.4Update to 2.1.4
- High7.21.8.4 - Unauthenticated Stored Cross-Site Scripting
FAQ Builder AYS
1.6.3 – 1.8.4Update to 1.8.5
- Medium5.3Missing Authorization
Quick Event Manager
≤9.18Update to 9.19
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.61Update to 1.0.62
- Medium4.42.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode
2.0.0 – 2.8.0Update to 2.8.1
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.12.13Update to 3.13.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Quick Event Manager
≤9.18Update to 9.19