CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 29)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 29)
Severity	Vulnerability	CVE	Installs	Published
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting JetElements≤2.9.2.6Update to 2.9.2.7	CVE-2026-39737	—	Oct 29
Medium5.3	Missing Authorization Flexible Quantity & Price Calculator for WooCommerce≤2.3.24Update to 2.3.25	CVE-2026-116856	—	Oct 29
Medium5.3	Missing Authorization SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.12.9Update to 2.13.0	CVE-2026-116387	—	Oct 29
Medium5.3	Missing Authorization WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell≤3.13.5Update to 3.13.6	CVE-2026-118091	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Kadence Blocks — Page Builder Toolkit for Gutenberg Editor≤3.8.0.2Update to 3.8.1	CVE-2026-39742	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors≤4.17.0Update to 4.18.0	CVE-2026-115610	—	Oct 29
Medium4.3	Missing Authorization MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.55Update to 3.7.56	CVE-2026-118092	—	Oct 29
Medium4.3	Missing Authorization Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar≤6.5.4Update to 6.5.5	CVE-2026-116406	—	Oct 29
Medium4.3	Missing Authorization User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14	CVE-2026-52708	—	Oct 29
Medium5.3	Missing Authorization WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory≤2.9.26Update to 2.10.0	CVE-2026-116846	—	Oct 29
Medium5.3	Missing Authorization User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14	CVE-2026-48884	—	Oct 29
Medium6.5	Authenticated (Contributor+) SQL Injection JetEngine≤3.9.0.1Update to 3.9.0.2	CVE-2026-39736	—	Oct 29
Medium5.3	Missing Authorization Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.27Update to 2.4.28	CVE-2026-39782	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting JetSmartFilters≤3.8.6.2Update to 3.8.6.3	CVE-2026-116857	—	Oct 29
Medium4.3	Cross-Site Request Forgery InstaWP Connect – 1-click WP Staging & Migration≤0.1.4.2Update to 0.1.4.3	CVE-2026-116399	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Import and export users and customers≤2.5.9Update to 2.5.10	CVE-2026-54862	—	Oct 29
Medium4.3	Missing Authorization HivePress Claim Listings≤1.1.4Update to 1.1.5	CVE-2026-42707	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting PDF Poster – Let visitors read PDF’s without leaving the page≤2.6.1Update to 2.6.2	CVE-2026-48195	—	Oct 29
Medium5.3	Missing Authorization Simple CAPTCHA with Cloudflare Turnstile≤1.44.0Update to 1.44.1	CVE-2026-39741	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.27Update to 2.4.28	CVE-2026-48196	—	Oct 29
Medium4.3	Missing Authorization WP Job Portal – AI-Powered Recruitment System for Company or Job Board website≤2.7.1Update to 2.7.2	CVE-2026-22386	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Video Gallery Block – showcase your videos in a filterable gallery≤1.6.0Update to 1.7.0	CVE-2026-52709	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Cozy Blocks – Website Builder & Business Growth Toolkit \| Popups, Lead Forms & Inbox≤2.2.27Update to 2.2.28	CVE-2026-24533	—	Oct 29
Medium4.3	Missing Authorization Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.27Update to 2.4.28	CVE-2026-42703	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Site Reviews≤8.3.5Update to 8.3.6	CVE-2026-118087	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19	CVE-2026-118094	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid≤7.9.7Update to 7.9.8	CVE-2026-56056	—	Oct 29
Medium4.3	Missing Authorization JetEngine≤3.9.0.1Update to 3.9.0.2	CVE-2026-39735	—	Oct 29
Medium5.3	Missing Authorization Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels≤7.14.1Update to 7.14.2	CVE-2026-118093	—	Oct 29
Medium5.3	Missing Authorization YITH PayPal Express Checkout for WooCommerce≤1.62.0Update to 1.62.1	CVE-2026-27401	—	Oct 29

Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.6Update to 2.9.2.7
CVE-2026-39737Oct 29
Medium5.3
Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.24Update to 2.3.25
CVE-2026-116856Oct 29
Medium5.3
Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.9Update to 2.13.0
CVE-2026-116387Oct 29
Medium5.3
Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.5Update to 3.13.6
CVE-2026-118091Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.8.0.2Update to 3.8.1
CVE-2026-39742Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.17.0Update to 4.18.0
CVE-2026-115610Oct 29
Medium4.3
Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.55Update to 3.7.56
CVE-2026-118092Oct 29
Medium4.3
Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.4Update to 6.5.5
CVE-2026-116406Oct 29
Medium4.3
Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
CVE-2026-52708Oct 29
Medium5.3
Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.26Update to 2.10.0
CVE-2026-116846Oct 29
Medium5.3
Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
CVE-2026-48884Oct 29
Medium6.5
Authenticated (Contributor+) SQL Injection
JetEngine
≤3.9.0.1Update to 3.9.0.2
CVE-2026-39736Oct 29
Medium5.3
Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
CVE-2026-39782Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6.2Update to 3.8.6.3
CVE-2026-116857Oct 29
Medium4.3
Cross-Site Request Forgery
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.2Update to 0.1.4.3
CVE-2026-116399Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Import and export users and customers
≤2.5.9Update to 2.5.10
CVE-2026-54862Oct 29
Medium4.3
Missing Authorization
HivePress Claim Listings
≤1.1.4Update to 1.1.5
CVE-2026-42707Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
PDF Poster – Let visitors read PDF’s without leaving the page
≤2.6.1Update to 2.6.2
CVE-2026-48195Oct 29
Medium5.3
Missing Authorization
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.0Update to 1.44.1
CVE-2026-39741Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
CVE-2026-48196Oct 29
Medium4.3
Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.1Update to 2.7.2
CVE-2026-22386Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Video Gallery Block – showcase your videos in a filterable gallery
≤1.6.0Update to 1.7.0
CVE-2026-52709Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
CVE-2026-24533Oct 29
Medium4.3
Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
CVE-2026-42703Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Site Reviews
≤8.3.5Update to 8.3.6
CVE-2026-118087Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
CVE-2026-118094Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.7Update to 7.9.8
CVE-2026-56056Oct 29
Medium4.3
Missing Authorization
JetEngine
≤3.9.0.1Update to 3.9.0.2
CVE-2026-39735Oct 29
Medium5.3
Missing Authorization
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.14.1Update to 7.14.2
CVE-2026-118093Oct 29
Medium5.3
Missing Authorization
YITH PayPal Express Checkout for WooCommerce
≤1.62.0Update to 1.62.1
CVE-2026-27401Oct 29