CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 64)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.0Update to 1.58.1
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.8Update to 8.8.9
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.6Update to 7.3.7
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.13Update to 7.5.14
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetMenu
≤3.0.5Update to 3.0.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.3Update to 2.9.2.4
- Medium4.3Missing Authorization
Flexible Subscriptions
≤1.8.4Update to 1.8.5
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.22Update to 2.9.23
- Medium5.3Missing Authorization
Products Restricted Users for WooCommerce
≤0.7Update to 0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Query Blocks
≤5.6.0Update to 5.7.0
- Medium4.3Missing Authorization
Event Post
≤6.1.1Update to 6.1.2
- Medium4.3Missing Authorization
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok
≤1.2.10Update to 1.2.11
- Medium4.3Missing Authorization
TMDS – Dropshipping for TEMU and Woo
≤1.0.15Update to 1.0.16
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Post
≤6.1.1Update to 6.1.2
- High8.1Unauthenticated PHP Object Injection
Motorix
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Meals & Wheels
≤1.1.13No patch available
- High8.1Unauthenticated PHP Object Injection
Gunslinger
≤1.11No patch available
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.23Update to 3.24
- Medium6.6Authenticated (Editor+) PHP Object Injection
Polylang
≤3.8.9Update to 3.8.10
- High8.1Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
Good Homes - Real Estate WordPress Theme
≤1.3.13No patch available
- High8.1Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.19No patch available
- High8.1Unauthenticated PHP Object Injection
gamezone
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
EmojiNation
≤1.0.12No patch available
- High8.1Unauthenticated PHP Object Injection
Edge Decor
≤2.9No patch available
- High8.1Unauthenticated PHP Object Injection
Coinpress
≤1.0.15No patch available