CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 60)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
Contact Form DB for Enfold
≤2.0.2No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
BuddyPress XProfile Custom Image Field
≤3.1.0No patch available
- Critical9.8Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
AGE-GATE
≤1.0No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via 'image.push' Method
JTL-Connector for WooCommerce
≤2.4.3No patch available
- Medium4.7Reflected Cross-Site Scripting via 'tab' Parameter
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
FV Player 8
≤8.1.7Update to 8.1.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- Medium5.3Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
Avada (Fusion) Builder
≤3.16.1Update to 3.16.2
- High7.5Unauthenticated SQL Injection via 'inputs' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.48Update to 1.15.49
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10.2.1Update to 8.10.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
AnyComment
≤0.3.6No patch available
- Critical9.8Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Abandoned Cart Pro for WooCommerce
≤10.8.0Update to 10.8.1
- High7.5Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
Abandoned Cart Pro for WooCommerce
≤10.8.0Update to 10.8.1
- Critical9.8Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
Abandoned Cart Pro for WooCommerce
≤10.8.0Update to 10.8.1
- Critical9.8Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
Snazzy Social Media Feed
≤2.5No patch available
- Critical9.8Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.9.1Update to 2.9.2
- High8.1Unauthenticated PHP Object Injection
Ozisti | Augmented Reality WooCommerce Theme
≤1.1.10No patch available
- High8.1Unauthenticated PHP Object Injection
Preservation
≤1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Printy
≤1.13.0No patch available
- High8.1Cryptocurrency & Coin ICO WordPress <= 1.2.6 - Unauthenticated PHP Object Injection
RexCoin - Cryptocurrency & Coin ICO WordPress
≤1.2.6No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- Medium6.1Reflected Cross-Site Scripting
Link Whisper Free
≤0.9.7Update to 0.9.8
- High7.3Unauthenticated Privilege Escalation
ACF Frontend Admin by DynamiApps
≤3.29.13Update to 3.30.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
YayMail – WooCommerce Email Customizer
≤4.4.6Update to 4.4.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.5Unauthenticated SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.2Update to 6.5.3
- High7.5Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
Membership & User Roles for WooCommerce (Automatic Role Changer)
≤20260828Update to 20261007
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10.2.1Update to 8.10.3
- Medium5.3Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
Database Addon for Contact Form 7 – CFDB7
≤1.4.1Update to 1.4.2