CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 67)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
WP Photo Album Plus
≤9.3.03.002Update to 9.3.03.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.12Update to 4.3.13
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
WP Meteor Website Speed Optimization Addon
≤3.4.18Update to 3.4.19
- Medium5.4Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.5Update to 6.2.6
- High7.2Authenticated (Custom+) PHP Object Injection via 'value' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
PPOM – Product Addons & Custom Fields for WooCommerce
≤34.0.10Update to 34.0.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
ACF Frontend Admin by DynamiApps
≤3.28.36Update to 3.29.1
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
WP File Download
≤6.3.9Update to 6.3.10
- Medium6.1Reflected Cross-Site Scripting via 'fvrt_' prefix
Favicon Rotator
≤1.2.11Update to 1.2.12
- Medium5.3Missing Authorization to Unauthenticated PNG File Upload
WP CV Builder
≤1.3.1Update to 1.3.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
WP Booking System – Booking Calendar
≤2.1.0.1Update to 2.1.0.2
- Medium6.1Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
Payment Plugins for Stripe WooCommerce
≤4.0.17Update to 4.0.18
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.15Update to 1.8.16
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.8Update to 2.34.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
Team – Team Members Showcase Plugin
≤6.0.2Update to 6.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via display_name User Field
Post Grid Gutenberg Blocks – PostX
≤5.1.0Update to 5.1.1
- Low3.7Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
SpeedyCache – Cache, Optimization, Performance
≤1.4.2Update to 1.4.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
SiteOrigin Widgets Bundle
≤1.74.3Update to 1.75.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
Simple Membership
≤4.8.4Update to 4.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
Responsive Lightbox & Gallery
≤2.7.9Update to 2.7.10
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
Presto Player
≤4.5.1Update to 4.5.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.2Update to 1.13.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
Podlove Podcast Publisher
≤4.5.6Update to 4.5.7
- Medium5.3Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Order Export & Order Import for WooCommerce
≤2.7.8Update to 2.7.9
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
Noptin – Newsletter, New Post Notifications & Email Automation
≤4.3.10Update to 4.4.0