CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 31)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
Greenshift – animation and page builder blocks
≤13.2.1Update to 13.2.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
Greenshift – animation and page builder blocks
≤13.2.1Update to 13.2.2
- Medium4.7Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.12Update to 5.2.13
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
Extensions for Leaflet Map
≤5.4Update to 6.0
- Medium6.1Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Medium5.3Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.11Update to 5.7.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
Sequential Order Numbers for WooCommerce
≤3.6.5Update to 3.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
Password Protected
≤2.8.4Update to 2.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
Schema App Structured Data
≤2.3.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
DSGVO All in one for WP
≤5.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
Food Store – Online Food Delivery & Pickup
≤1.5.5No patch available
- High7.5Unauthenticated SQL Injection via 'subscriberid' Parameter
SendPress Newsletters
≤1.26.1.20No patch available
- High7.5Unauthenticated SQL Injection via 'exclude_posts' Parameter
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
Bot for Telegram on WooCommerce
≤1.3.0No patch available
- High8.1Unauthenticated Authentication Bypass to Account Takeover
SSL Wireless SMS Notification
≤3.8.1No patch available
- High7.5Authentication Bypass via SSO Email-Collision Account Binding on Multisite
Wild Apricot Login
≤1.0.18No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Dynamic QR Code
≤1.0.1No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
myPOS Checkout
≤1.4.5No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
News Kit Addons For Elementor
≤1.5.0No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
≤2.21.0No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
WP Media folders
≤1.1.10No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Frisbii Pay
≤1.8.19Update to 1.8.20
- High7.5Authenticated (Author+) PHP Object Injection
Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor
≤1.2.3No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Product Catalog Feed by PixelYourSite
≤3.1.4No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
FV Flowplayer Video Player
≤7.5.56.7212Update to 7.5.57.7212
- High7.5Authenticated (Contributor+) PHP Object Injection
Social Snap — Social Share Buttons & Click to Tweet
≤1.5.4No patch available