CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 2)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
- Medium5.3Missing Authorization
Redirection for Contact Form 7
<3.2.16Update to 3.2.16
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.10.4Update to 2.10.5
- Medium4.3Cross-Site Request Forgery
vice
≤1.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.9.11Update to 5.9.12
- Medium5.3Missing Authorization
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1235Update to 4.1236
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Simpler Checkout
<1.5.4Update to 1.5.4
- High7.3Unauthenticated Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.58.4Update to 1.58.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP
<1.70Update to 1.70
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤10.0.4Update to 10.0.5
- Medium4.3Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.22Update to 3.0.23
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Schema & Structured Data for WP & AMP
<1.70Update to 1.70
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Display Eventbrite Events
≤6.9.1Update to 6.9.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
<1.15.8Update to 1.15.8
- Medium4.3Cross-Site Request Forgery
Mazino
≤1.1No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Dynific Addons for Elementor (formerly Anywhere Elementor)
<1.3.1Update to 1.3.1
- Medium4.3Missing Authorization
Schema & Structured Data for WP & AMP
<1.70Update to 1.70
- Low2.7Missing Authorization
Code Snippets
<4.1.0Update to 4.1.0
- Medium5.3Unauthenticated Information Exposure
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.58.4Update to 1.58.4
- Medium5.3Missing Authorization
ZoloBlocks – Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit
≤2.8.2Update to 2.8.4
- Medium5.3Missing Authorization
Event Tickets and Registration
<5.30.3.1Update to 5.30.3.1
- Medium5.3Missing Authorization
Create
≤3.1.1Update to 3.1.2
- Medium4.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.2Update to 2.8.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤10.0.3Update to 10.0.4
- Medium4.3Missing Authorization
Photo Engine (Media Organizer & Lightroom)
<6.6.2Update to 6.6.2
- Medium4.3Authenticated (Contributor+) Information Exposure
Dynific Addons for Elementor (formerly Anywhere Elementor)
<1.3.1Update to 1.3.1
- Medium5.3Missing Authorization
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.87Update to 51.1.90
- Medium4.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.18.2Update to 11.18.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.51.0Update to 3.51.3
- Medium4.3Cross-Site Request Forgery
Leo
≤1.7.4No patch available
- Medium4.3Missing Authorization
E2Pdf – Export Pdf Tool for WordPress
≤1.32.65Update to 2.00.00