CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 71)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
HootBoard – Bulletin Board For Your Organization & Team Communication
≤3.1.4No patch available
- Medium5.3Missing Authorization
Insurify – Order & Shipping Protection
≤1.0No patch available
- Medium5.3Missing Authorization
Quick quotes – WPSHARE247
≤1.0.0No patch available
- Medium5.3Missing Authorization
Insurify – Order & Shipping Protection
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Gravity Forms
≤1.0.3No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to WPForms
≤1.0.3No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to Ninja Forms
≤1.0.1No patch available
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium4.3Cross-Site Request Forgery
Hotel Booking
≤3.8No patch available
- Medium5.3Missing Authorization
Fundiin cho WooCommerce
≤3.4.0No patch available
- High7.5Unauthenticated SQL Injection
Tcard WP
≤1.8.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.1Update to 2.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.5Update to 3.13.6
- High8.1Unauthenticated Local File Inclusion
TouchUp - Cosmetic and Plastic Surgery WordPress Theme
<1.4Update to 1.4
- Medium6.5Authenticated (Contributor+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
4.0.0 – <4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Squadeno – Club Sports Manager
≤1.11.0Update to 1.12.0
- Medium4.3Authenticated (Subscriber+) Payment Bypass
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
≤3.2.9Update to 3.2.10
- Medium4.3Missing Authorization
AutoPoly – AI Translation For Polylang
≤1.6.2Update to 1.6.3
- Medium5.3Missing Authorization
WeddingCity Lite – Wedding Directory and Listing
≤1.0.4No patch available
- High7.2Authenticated (Admin+) Arbitrary Plugin Installation
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Critical9.8Unauthenticated Arbitrary File Upload
Anton Extensions
≤1.2.2No patch available
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP-Invoice – Web Invoice and Billing
≤4.3.1No patch available
- High7.5Unauthenticated SQL Injection
Datalist it
≤0.0.3No patch available
- Medium5.3Missing Authorization
WP Posts Password Batch Manager
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP-Partner
≤1.2.1No patch available
- High7.5Unauthenticated SQL Injection
Llavero.io
≤0.1.4No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Mindstien Quick Login
≤1.0No patch available