CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 143)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.8.5Update to 5.8.6
- Medium5.3Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- Medium5.3Unauthenticated Payment Bypass
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.8Update to 2.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Xpro Addons — 150+ Widgets for Elementor
≤1.7.3Update to 1.7.4
- High8.1Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Ninja Forms - Layout & Styles
≤3.0.31Update to 3.0.32
- High7.5Unauthenticated SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.1Update to 3.8.2
- Critical9.8Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
Nokri – Job Board WordPress Theme
≤1.6.6Update to 1.6.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
WPBakery Page Builder
≤8.7.4Update to 9.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
Welcart e-Commerce
≤2.12.1Update to 2.12.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
Blocksy Companion
≤2.1.51Update to 2.1.52
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.1Update to 1.8.12.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.8.1Update to 4.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- High8.8Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
≤1.4.52Update to 1.4.53
- Medium4.9Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.2Update to 5.9.3
- Medium5.3Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.17Update to 2.2.18
- High7.2Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
Affiliate Super Assistent
≤1.10.2Update to 1.10.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
Photo Gallery by Ays – Responsive Image Gallery
≤6.8.2Update to 6.8.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
Persistent Login
≤3.1.0Update to 3.1.1
- High7.2Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.9Update to 3.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- High7.2Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤5.8.1Update to 5.9.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.4Update to 4.4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
ACF Frontend Admin by DynamiApps
≤3.29.11Update to 3.29.12
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2