CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 144)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.1Update to 1.8.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)
≤4.0.0Update to 4.0.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Kalles Addons
≤1.0.6No patch available
- High7.2Unauthenticated Server-Side Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.15.0Update to 8.16.0
- Medium5.3Missing Authorization to Unauthenticated Unpublished Site Builder Content Disclosure
Solace Extra
<1.7.0Update to 1.7.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.10Update to 4.3.11
- High7.3Unauthenticated Privilege Escalation
Uix UserCenter
≤1.0.3No patch available
- Medium4.3Cross-Site Request Forgery
JetStyleManager for Gutenberg
<1.3.9Update to 1.3.9
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.3Unauthenticated Privilege Escalation
MemberHero – Simple User Registration & Login
≤6.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium5.3Unauthenticated Payment Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Missing Authorization
bbPress
≤2.6.14Update to 2.6.15
- High8.8Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
≤8.0.1Update to 8.0.2
- Medium5.3Unauthenticated Password-Protected Post Content Disclosure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277.1Update to 1.0.277.1
- High7.5Unauthenticated SQL Injection
Rest Routes – Custom Endpoints for WordPress REST API
≤5.5.5No patch available
- High8.1Unauthenticated Arbitrary Plugin Installation via Brute Force
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.1Update to 4.17.2
- Critical9.8Unauthenticated Arbitrary File Upload
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
WP Recipe Maker Premium
≤10.5.0Update to 10.6.0
- Medium5.35.0.14 - Unauthenticated Information Exposure
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
5.0.13 – 5.0.14Update to 5.0.15
- High7.3Unauthenticated Arbitrary User Account Takeover
OAuth Single Sign On – SSO (OAuth Client)
≤7.0.0Update to 7.0.1
- Critical9.8Unauthenticated Privilege Escalation via Administrator Account Takeover
Advanced Custom Fields: Extended
<0.9.2.7Update to 0.9.2.7
- Medium4.9Authenticated (Admin+) Denial of Service
Kubio AI Page Builder
<2.9.1Update to 2.9.1
- High7.2Unauthenticated Server-Side Request Forgery
Total processing card payments for WooCommerce
≤7.3No patch available
- Medium5.3Unauthenticated Information Exposure
HEL Online Classroom: AI-powered Online Classrooms
≤1.0.3No patch available
- Medium5.3Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.1Update to 4.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Customer Reviews for WooCommerce
<5.118.0Update to 5.118.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
≤0.8.7Update to 0.8.8
- Medium5.3Unauthenticated Payment Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9