CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 39)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Discussion Board – WordPress Forum Plugin
≤2.6.0Update to 2.6.1
- Medium4.3Cross-Site Request Forgery
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.5.2Update to 3.8.6
- Medium4.3Missing Authorization
DEPART – Deposit and Part payment for Woo
≤1.0.10Update to 1.1.0
- Medium4.3Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.6Update to 3.8.7
- Medium5.3Missing Authorization
Link Library
≤7.9.0Update to 7.10.0
- High7.5Unauthenticated SQL Injection
vTables – Data Table Builder for CSV, Excel & JSON
≤0.2Update to 0.3
- Medium5.35.45 - Unauthenticated Payment Bypass
PAYCOMET for WooCommerce
5.36 – 5.45Update to 5.46
- Medium5.3Unauthenticated Information Exposure
Link Library
≤7.9.0Update to 7.10.0
- Medium5.3Unauthenticated Discount Code Limit Bypass
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.1Update to 3.7.2
- Medium4.7Unauthenticated HTML Injection
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.9Update to 5.7.10
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
Advanced Post Block – Display Your Posts Exactly How You Want
≤2.5.1Update to 2.5.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Advanced Ads – Tracking
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Arbitrary Email Header Injection
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium5.3Missing Authorization
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- High7.2Authenticated (Administrator+) Remote Code Execution
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium5.33.6.3 - Unauthenticated Information Exposure
Recipe Card Blocks Lite
2.6.4 – 3.6.3Update to 3.6.4
- Medium5.3Missing Authorization to Unauthenticated Roster Member Deletion
WP Roster
<2.35Update to 2.35
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
<3.42Update to 3.42
- Medium4.7Unauthenticated Open Redirect
Welcart e-Commerce
<2.12.6Update to 2.12.6
- Medium5.3Unauthenticated Login URL Settings Modification
WPOrLogin – Custom Login, Social Login, CAPTCHA & Security
<3.1.0Update to 3.1.0
- High7.36.8.6 - Unauthenticated Registration Approval Bypass
Essential Addons for Elementor – Popular Elementor Templates & Widgets
6.7.3 – 6.8.6Update to 6.8.7
- Medium5.3Unauthenticated Unauthorized Email Relay
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1070Update to 1.7.1070
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng
<4.2.0Update to 4.2.0
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
UniPAY Payment Gateway For WooCommerce
≤2.3Update to 2.4
- Medium5.3Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Confirmation
Sadad QA Payment
≤1.28Update to 1.29
- Medium5.3Unauthenticated Payment Bypass
BitPay Gateway for WooCommerce
≤4.1.3No patch available
- Medium5.31.2.1 - Unauthenticated Order Payment Forgery
TiendaCrypto para WooCommerce
1.0.1 – 1.2.1No patch available
- Medium5.3Unauthenticated Payment Bypass
PAYDUNYA WOOCOMMERCE PAR
≤1.1.6No patch available