CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 147)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.5Update to 5.2.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
≤1.7.1Update to 1.7.2
- High7.3Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium4.31.8.5.4 - Missing Authorization
Content Mask
1.8.0 – 1.8.5.4Update to 1.8.5.5
- Medium4.38.9.2 - Authenticated (Subscriber+) Arbitrary Image Move
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.5 – 8.9.2Update to 8.9.3
- Medium5.3Unauthenticated Payment Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.1Update to 1.57.2
- Medium6.5Authenticated (Custom Role+) Arbitrary File Read
Tutor LMS – eLearning and online course solution
<4.0.6Update to 4.0.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Fluent Forms Pro Add On Pack
≤6.2.12Update to 6.2.13
- Medium5.3Missing Authorization
Return Refund and Exchange For WooCommerce
<4.6.4Update to 4.6.4
- Critical9.1Unauthenticated Arbitrary File Deletion
Shared Files – File Upload & Download Manager
<1.7.67Update to 1.7.67
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Login, Social Sharing by miniOrange
≤7.8.2Update to 7.9.0
- High7.32.12.1 - Unauthenticated Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
2.6.7 – 2.12.1Update to 2.13.0
- High7.23.19.16 - Unauthenticated Stored Cross-Site Scripting
12 Step Meeting List
3.17 – 3.19.16Update to 3.19.17
- High7.5Unauthenticated SQL Injection
Throws SPAM Away
≤3.8.2Update to 3.9
- Medium4.7Authenticated (Editor+) Privilege Escalation
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
<4.1.18Update to 4.1.18
- High8.8Authenticated (Author+) Remote Code Execution
Pods – Custom Content Types and Fields
<3.3.9.1Update to 3.3.9.1
- High7.5Unauthenticated Arbitrary Document Download
Document Embedder – let visitors read files without downloading
<2.3.1Update to 2.3.1
- Medium5.3Missing Authorization
Simple Payment
≤2.5.2Update to 2.5.3
- Critical9.81.0.48 - Backdoor
Newspapers X
1.0.46 – 1.0.48Update to 1.0.49
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<11.2.4Update to 11.2.4
- Medium5.33.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
3.4.0 – 3.7.1Update to 3.7.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Slider Hero with Video Background, Animation
<9.1.3Update to 9.1.3
- High7.2Unauthenticated Server-Side Request Forgery
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates
<2.7.2Update to 2.7.2
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.6Update to 5.2.6
- Critical9.8Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
WPMU DEV Dashboard
≤5.0.1Update to 5.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
Avada (Fusion) Builder
≤3.15.6Update to 3.16
- Medium6.5Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
Tutor LMS – eLearning and online course solution
≤4.0.5Update to 4.0.6
- High7.5Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
One User Avatar | User Profile Picture
≤2.5.4Update to 2.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LiteSpeed Cache
≤7.8.1Update to 7.9
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
LiteSpeed Cache
≤7.7Update to 7.8