CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 18)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
- Critical9.8Unauthenticated Privilege Escalation
OAuth Single Sign On – SSO (OAuth Client)
≤7.1.3Update to 7.1.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium4.3Missing Authorization
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
≤2.11.2Update to 2.11.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
<5.0.0Update to 5.0.0
- Medium5.3Missing Authorization
EventPrime – Events Calendar, Bookings, Tickets & AI
<4.3.6.1Update to 4.3.6.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Premium Packages – Sell Digital Products Securely
<7.3.1Update to 7.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Premium Packages – Sell Digital Products Securely
<7.3.1Update to 7.3.1
- Medium5.3Missing Authorization
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤6.0.6Update to 6.0.7
- Medium4.34.2.0 - Authenticated (Subscriber+) Information Exposure
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
3.9.0 – 4.2.0Update to 4.3.1
- Medium4.34.2.0 - Missing Authorization
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
3.6.0 – 4.2.0Update to 4.3.1
- Medium5.3Missing Authorization
MC4WP: Mailchimp for WordPress
≤4.14.0Update to 4.15.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
MC4WP: Mailchimp for WordPress
≤4.14.0Update to 4.15.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
≤6.90Update to 6.91
- Medium4.9Authenticated (Administrator+) Path Traversal
WPvivid — Backup, Migration & Staging
<0.9.138Update to 0.9.138
- Medium5.3Missing Authorization
WP Roster
<2.36Update to 2.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Typing – grab attention with animated typing headlines
<2.2.2Update to 2.2.2
- Medium4.9Authenticated (Administrator+) Path Traversal
WPvivid — Backup, Migration & Staging
<0.9.137Update to 0.9.137
- Low2.7Authenticated (Administrator+) Arbitrary Database Table Deletion
WPvivid — Backup, Migration & Staging
<0.9.137Update to 0.9.137
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Enable Media Replace
<4.2.3Update to 4.2.3
- High7.5Unauthenticated SQL Injection
GS JWT Authentication for WP REST API
≤1.0.0No patch available
- Medium5.3Unauthenticated Full Path Disclosure
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<5.1.0Update to 5.1.0
- Medium5.3Unauthenticated Information Exposure
WP Remote Users Sync
<2.2.0Update to 2.2.0
- Medium4.3Missing Authorization
Post Duplicator
<3.0.17Update to 3.0.17
- Medium4.35.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Essential Real Estate
4.4.3 – 5.3.4Update to 5.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
≤6.8.10Update to 6.8.11
- Medium6.43.1.2 - Authenticated (Contributor+) Server-Side Request Forgery
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
2.10.0 – 3.1.2Update to 3.1.3
- Medium4.37.5.56.7211 - Missing Authorization
FV Flowplayer Video Player
7.4.44.727 – 7.5.56.7211Update to 7.5.56.7212
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
FV Flowplayer Video Player
<7.5.56.7212Update to 7.5.56.7212
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
SEOPress – AI SEO Plugin & On-site SEO
<10.4Update to 10.4
- Medium5.3Missing Authorization
Mollie Payments for WooCommerce
<8.2.0Update to 8.2.0