CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 53)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
WebberZone Top 10 — Popular Posts
≤4.5.2Update to 4.5.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
≤2.7.7Update to 2.7.8
- Medium6.8Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
Photo Engine (Media Organizer & Lightroom)
≤6.5.6Update to 6.5.7
- Medium5.4Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
WPeMatico RSS Feed Fetcher
≤2.9Update to 2.9.1
- Medium6.5Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
≤2.9.5Update to 2.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MDTF – Meta Data and Taxonomies Filter
≤1.4.0Update to 1.4.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium4.3Missing Authorization
WordLift – AI powered SEO – Schema
≤3.54.15Update to 3.54.17
- Medium4.3Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6Update to 3.8.6.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
Premium Packages – Sell Digital Products Securely
≤7.2.8Update to 7.3.0
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)
≤1.1.9Update to 1.2.0
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.12Update to 3.3.13
- Low2.7Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
WP Mail Logging
≤1.17.0Update to 1.17.1
- High8.8Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.5Update to 1.4.6
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
WP Booking System – Booking Calendar
≤2.1.0.1Update to 2.1.0.2
- Medium4.8Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
WP Compress – Instant Performance & Speed Optimization
≤7.25.00Update to 7.26.00
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium6.5Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
Vitepos – Point of Sale (POS) for WooCommerce
≤3.6.1Update to 3.6.2
- High7.2Unauthenticated Stored Cross-Site Scripting via File Upload
Ultra Addons for Contact Form 7
≤3.5.54Update to 3.5.55
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤3.0.1Update to 3.0.2
- High8.0Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
Search Regex
≤3.5Update to 3.5.1
- Critical9.8Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
Theme My Login
≤7.2.1Update to 7.2.2
- High7.5Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.5Update to 2.34.8