CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 26)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.65Update to 1.0.66
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar
≤6.18.2Update to 6.18.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Blocksy Companion
≤2.1.60Update to 2.1.61
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
Redux Framework
≤4.5.15Update to 4.5.16
- High7.5Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- High7.5Authenticated (Subscriber+) PHP Object Injection
Enable Media Replace
≤4.2.2Update to 4.2.3
- High8.8Authenticated (Author+) Remote Code Execution
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
≤4.2.5Update to 4.2.6
- High7.5Authenticated (Contributor+) PHP Object Injection
Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews
≤3.3.10No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.14.1Update to 7.14.2
- High7.2Unauthenticated Stored Cross-Site Scripting
All In One Login
≤2.4.1Update to 2.5.0
- High8.1Unauthenticated PHP Object Injection
LeadSnap
≤1.25No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.19Update to 2.8.20
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WP BASE Booking of Appointments, Services and Events
≤6.5.2Update to 6.6.1
- Medium5.3Unauthenticated Information Exposure
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.6Update to 1.4.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.20Update to 5.0.21
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.4.6Update to 2.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.9Update to 1.4.10
- Medium5.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.1Update to 4.19.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
eCommerce Product Catalog
≤3.6.5Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Fast Velocity Minify
≤3.5.7Update to 3.5.8
- High7.5Authenticated (Subscriber+) PHP Object Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.55Update to 3.7.56
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.0Update to 5.3.1
- High7.3Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.2Update to 4.0.3
- Medium6.3Authenticated (Contributor+) Privilege Escalation
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.5Update to 4.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.5Update to 4.0.6
- Medium5.3Missing Authorization
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.6Update to 1.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
BA Book Everything
≤1.8.33Update to 1.8.34
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Customer Area
≤8.4.0Update to 8.4.1
- High7.5Unauthenticated Path Traversal
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.4Update to 4.5.5