CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 32)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) PHP Object Injection
10WebSocial
≤1.5.6No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Hotel Booking
≤3.8No patch available
- Medium5.3Unauthenticated Information Exposure
WP Crowdfunding
≤2.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
GlobalPayments Gateway Provider for WooCommerce
≤1.23.3No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
BuddyPress Xprofile Custom Field Types
≤1.3.1No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Extra Fees for WooCommerce
≤4.4.0No patch available
- High7.5Authenticated (Author+) PHP Object Injection
WPCargo Track & Trace
≤8.0.5No patch available
- Medium6.6Authenticated (Editor+) PHP Object Injection
Zippy
≤1.7.0No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation
BuddyBoss Platform
≤3.5.0Update to 3.6.1
- High8.1Unauthenticated Authentication Bypass
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.190Update to 2.191
- Medium5.3Missing Authorization
Bricks Builder
≤2.4.3Update to 2.4.4
- Medium5.3Missing Authorization
Court Reservation – Tennis, Padel & Sports Court Booking
<1.12.4Update to 1.12.4
- Medium4.3Authenticated (Contributor+) Information Exposure
Page Builder by SiteOrigin
<2.38.0Update to 2.38.0
- Medium5.8Unauthenticated CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization to Unauthenticated Information Exposure
PiWeb Disable payment method / Partial payment for WooCommerce
<1.1.10.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox
≤2.3.22Update to 2.3.23
- Medium4.3Missing Authorization
BuddyForms
≤2.10.0Update to 2.10.1
- Medium5.3Unauthenticated Information Exposure
BuddyForms
≤2.10.2Update to 2.10.3
- Medium4.3Missing Authorization
Fraud Prevention For WooCommerce and EDD
≤2.3.5Update to 2.3.6
- Medium6.46.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
Joinchat – Enhanced “click to chat”
6.3.2 – 6.4.1Update to 6.4.2
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.8
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.8
- Medium4.3Missing Authorization
My auctions allegro
≤4.0.3Update to 4.0.4
- Medium6.53.6.3 - Authenticated (Contributor+) SQL Injection
Recipe Card Blocks Lite
3.5.0 – 3.6.3Update to 3.6.4
- Medium6.1Reflected Cross-Site Scripting
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
- High7.2Unauthenticated Server-Side Request Forgery
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- High7.2Authenticated (Administrator+) Remote Code Execution
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- Low2.7Authenticated (Administrator+) Information Exposure
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.190Update to 2.191
- High8.14.2.2 - Unauthenticated PHP Object Injection
Enable Media Replace
4.1.4 – 4.2.2Update to 4.2.3