CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 37)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode
≤3.9.6Update to 3.9.7
- Medium4.8Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
Advanced Custom Fields: Extended
≤0.9.2.6Update to 0.9.2.7
- Critical9.8Authentication Bypass via Social Login
Qode Membership
≤2.0.6.2Update to 2.0.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
Jupiter X Core
≤4.61.0Update to 4.62.0
- High8.8Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.5Update to 6.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.7Update to 1.3.8
- Medium4.3Missing Authorization
Customer Coupons for WooCommerce
≤1.3.14Update to 1.3.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Button Block – Stylish buttons that get more clicks
≤1.2.7Update to 1.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Typing – grab attention with animated typing headlines
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Content Slider Block – Bring your content to life with slides
≤3.2.1Update to 3.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All In One Lightbox – show any media in beautiful popups
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.7Update to 1.3.8
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Booking for Appointments and Events Calendar – Amelia
≤2.4.12Update to 2.4.13
- High7.2Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
Analytics Insights – Google Analytics Dashboard for WordPress
≤6.3.12Update to 6.4
- High8.1Unauthenticated PHP Object Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- High7.5Authenticated (Author+) PHP Object Injection
Filter Everything — WordPress & WooCommerce Filters
≤1.9.7Update to 1.9.8
- High7.5Authenticated (Contributor+) PHP Object Injection
Phoenix Media Rename
≤3.13.5Update to 3.13.6
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.1Update to 5.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
Logo Slider – Logo Carousel, Logo Showcase, Logo Gallery & Client Logos
≤3.8.9Update to 3.9.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Accordions
≤2.3.25No patch available
- High8.1Unauthenticated PHP Object Injection
Zoho Flow – No-Code Workflow Automation
≤2.14.5Update to 2.14.6
- Medium5.3Missing Authorization
Optima Express IDX
≤9.0.1No patch available
- Medium4.3Missing Authorization
Redux Framework
≤4.5.16Update to 4.5.17
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyPress
≤14.5.2Update to 14.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Program Suite — SliceWP Affiliates
≤1.2.13Update to 1.2.14
- Medium5.3Unauthenticated Information Exposure
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.5Update to 1.10.7
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.24Update to 2.0.25