CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 49)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Contributor+) Arbitrary File Upload
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Property Listings
≤3.5.26Update to 3.5.27
- Medium5.3Unauthenticated Information Exposure
Easy Property Listings
≤3.5.27Update to 3.5.28
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium5.4Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.2Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
European VAT Compliance Assistant for WooCommerce
≤1.36.10Update to 1.36.11
- High7.2Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.61Update to 2.8.62
- Medium6.4Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
YMC Filter
≤3.12.19Update to 3.12.20
- Medium4.3Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
News Kit Addons For Elementor
≤1.4.8Update to 1.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
≤1.4.2Update to 1.4.3
- Medium4.9Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
Post Export Import with Media
≤1.17.2Update to 1.18.0
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Cross-Site Request Forgery to trigger_bulk_action()
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium6.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
WP Booking System – Booking Calendar
≤2.1.0.3Update to 2.1.0.4
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
WP Booking System – Booking Calendar
≤2.1.0.3Update to 2.1.0.4
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
WP Booking System – Booking Calendar
≤2.1.0.3Update to 2.1.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
EU VAT Assistant for WooCommerce
≤2.1.30.260413Update to 2.2.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
Themify Popup
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
Themify Builder
≤7.8.2Update to 7.8.3
- Medium4.9Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
Welcart e-Commerce
≤2.12.4Update to 2.12.5
- Critical9.8Unauthenticated PHP Object Injection via 'checkout-email' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Low3.7Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.2Update to 6.4.0
- Critical9.1Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium6.1Reflected Cross-Site Scripting via 'token_id' Parameter
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.2Update to 6.4.0