CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 139)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.53.2.10 - Unauthenticated Arbitrary Shortcode Execution
Redirection for Contact Form 7
2.2.7 – 3.2.10Update to 3.2.11
- Medium6.1Reflected Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
<3.0.1Update to 3.0.1
- Medium5.3Missing Authorization
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.26Update to 6.4.27
- Medium6.37.1.15 - Authenticated (Subscriber+) Privilege Escalation
Theme My Login
7.0 – 7.1.15Update to 7.2.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
MountDev AI MCP Connector for WordPress
≤1.6.5Update to 1.6.6
- Medium6.33.1.23.3 - Authenticated (Subscriber+) Privilege Escalation
JetBackup – Backup, Restore & Migrate
3.1.7.9 – 3.1.23.3Update to 3.1.23.5
- Medium5.3Missing Authorization
Fluent Booking Pro
≤2.2.1Update to 2.3.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.26Update to 6.4.27
- Medium4.3Missing Authorization to Authenticated (Author+) SEO Object Updates
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- Medium5.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.17Update to 2.0.18
- Medium5.3Unauthenticated Information Exposure
KP Agent Ready
≤1.1.99Update to 1.2.08
- High7.5Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
LearnDash LMS
≤5.1.5Update to 5.1.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium4.34.6.3 - Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification
EmbedPress
4.6.0 – 4.6.3Update to 4.6.4
- Medium5.3Missing Authorization to Unauthenticated JetEngine Options Page Modification
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.2Update to 3.6.2.1
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.5Update to 4.4.6
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Missing Authorization
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.5.3Update to 1.5.4
- Medium4.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
<7.9.9.6Update to 7.9.9.6
- Medium4.3Missing Authorization
Agentimus – AI SEO, llms.txt & MCP for AI Agents
≤1.51.0Update to 1.51.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Ajax Chat – Add a Fast, Secure Chat Box
<20260827Update to 20260827
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.8.44Update to 1.8.44
- High7.2Unauthenticated Stored Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.9.9Update to 6.0.9.9
- Medium5.34.0.7 - Unauthenticated Password-Protected Post Content Disclosure
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
4.0.0 – 4.0.7Update to 4.0.8
- Medium5.3Missing Authorization
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium6.4Authenticated (Instructor+) Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.5Update to 4.4.6
- Medium5.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.6.0.3Update to 2.6.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPKoi Templates for Elementor
≤3.7.2Update to 3.7.3
- High7.30.9.2.6 - Unauthenticated Privilege Escalation
Advanced Custom Fields: Extended
0.9.2.2 – 0.9.2.6Update to 0.9.2.7