CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 14)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
- Medium4.33.4.0 - Two-Factor Authentication Bypass
Limit Login Attempts Security
3.0.0 – 3.4.0Update to 3.4.1
- Medium4.3Two-Factor Authentication Bypass
Limit Login Attempts Security
≤3.4.0Update to 3.4.1
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Grand Job
≤1.2.1No patch available
- Critical9.8Unauthenticated Administrator Credential Exposure
EASY-JS-WPAPI Client HANDLE for the WordPress REST-API
≤2.0No patch available
- High7.3Unauthenticated Privilege Escalation
Userplace – Member Subscription, Restriction & Payments
≤1.2.0No patch available
- Medium4.3Missing Authorization
Sync Post With Other Site
≤1.9.3Update to 1.9.4
- Medium5.3Unauthenticated Persistent Unauthorized Account Access
JWT Auth – WordPress JSON Web Token Authentication
≤3.0.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Razorpay for WooCommerce
≤4.8.8Update to 4.8.9
- Medium5.3Missing Authorization
Razorpay for WooCommerce
≤4.8.8Update to 4.8.9
- Medium5.3Unauthenticated Information Exposure
Razorpay for WooCommerce
≤4.8.8Update to 4.8.9
- Medium4.3Authenticated (Subscriber+) Arbitrary Backup Directory Deletion
BackUpWordPress
≤3.14Update to 3.15
- High7.2Unauthenticated Stored Cross-Site Scripting
Turisbook Booking System
≤1.3.8No patch available
- Medium4.311.0.1 - Insecure Storage of Password
WooCommerce Stripe Payment Gateway
10.9.0 – 11.0.1Update to 11.1.0
- Medium5.31.5.9 - Unauthenticated Payment Bypass
Event Tickets Manager for WooCommerce
1.5.4 – 1.5.9Update to 1.6.0
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WP BASE Booking of Appointments, Services and Events
≤6.5.0Update to 6.5.1
- Low2.7Missing Authorization
Post Duplicator
≤3.0.17Update to 3.0.18
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.5Update to 4.3.6
- Medium5.3Unauthenticated Information Exposure
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.1.0Update to 5.1.1
- Medium5.3Unauthenticated Information Exposure
Mail Debug for WooCommerce
≤1.3.0No patch available
- Critical9.80.4.7 - Unauthenticated Remote Code Execution
Confection WordPress Cable
0.4.0 – 0.4.7No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
mView 豆瓣电影
≤1.0.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Write
AZEXO Store Locator
≤1.4No patch available
- High7.5Unauthenticated SQL Injection
Productive Commerce – Wishlist, Compare & MiniCart
≤1.1.53Update to 1.1.54
- Critical9.8Unauthenticated Account Takeover visa Brute Force
Ecommerce Affiliate
≤1.0.0No patch available
- Medium5.31.12.1 - Missing Authorization
FraudLabs Pro SMS Verification
1.11.2 – 1.12.1No patch available
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Feed Item Title
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.13Update to 5.2.14
- Medium6.5Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.8Update to 3.3.9
- High7.5Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()
WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database
≤1.8.0Update to 1.8.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
WP Customer Area
≤8.4.0Update to 8.4.1