CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 146)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
KiviCare – Clinic & Patient Management System (EHR)
≤4.5.4Update to 4.5.5
- Medium5.3Unauthenticated Information Exposure
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<4.3.10Update to 4.3.10
- Medium4.3Missing Authorization
OwnerRez
≤1.2.6Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Super Store Finder
≤7.10Update to 7.11
- High7.5Unauthenticated SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.81Update to 5.5.82
- High7.2Unauthenticated Stored Cross-Site Scripting
Email Essentials
≤6.0.6Update to 6.0.7
- High7.3Unauthenticated Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.17.1Update to 4.17.1
- High7.5Unauthenticated SQL Injection
Smart Marketing SMS and Newsletters Forms
≤5.1.24Update to 5.1.25
- High7.3Unauthenticated Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.57.1Update to 1.57.1
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.57.0.7Update to 1.57.0.7
- Medium6.39.7 - Authenticated (Provider+) Arbitrary Provider Password Update
Booking for Appointments and Events Calendar – Amelia
9.0 – 9.7Update to 9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spiffy Calendar
≤5.0.8Update to 5.0.9
- High8.1Unauthenticated PHP Object Injection
Tickera – Sell Tickets & Manage Events
≤3.6.0.2Update to 3.6.0.3
- Medium6.6Authenticated (Editor+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<4.3.10Update to 4.3.10
- High7.2Authenticated (Shop Manager+) Remote Code Execution
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<5.0.14Update to 5.0.14
- Medium4.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.6Update to 2.7.7
- Medium5.3Unauthenticated Arbitrary Price Manipulation
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
<2.1.2Update to 2.1.2
- Medium5.3Missing Authorization
Fluent Forms Pro Add On Pack
≤6.2.12Update to 6.2.13
- Medium5.3Unauthenticated Information Exposure
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
<3.7.1Update to 3.7.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
MW WP Form
<5.1.6Update to 5.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Program Suite — SliceWP Affiliates
≤1.2.10Update to 1.2.11
- Medium6.5Authenticated (Contributor+) SQL Injection
WPBulky – WordPress Bulk Edit Post Types
≤1.2.2Update to 1.2.3
- Critical9.8Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field
SigmaForms Pro – AI Generated Forms
≤1.4.5Update to 1.4.6
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.7.1Update to 4.16.7.2
- Medium5.3Unauthenticated Information Exposure
WP OAuth Server ( Login with WordPress )
<6.3.1Update to 6.3.1
- Medium6.1Reflected Cross-Site Scripting
Tangible: Loops & Logic
≤4.3.1No patch available
- Medium5.32-Factor Authentication Bypass
Security Optimizer – The All-In-One Protection Plugin
≤1.6.6Update to 1.6.7
- Critical9.8Unauthenticated Arbitrary File Upload
Hash Form – Drag & Drop Form Builder
≤1.4.2Update to 1.4.3
- High7.2Unauthenticated Stored Cross-Site Scripting
LeadConnector
≤4.0.5Update to 4.0.6
- Medium5.3Unauthenticated File Creation via Path Traversal
Breeze Cache
<2.5.13Update to 2.5.13