CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 72)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
click5 CRM add-on to Gravity Forms
≤1.0.3No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlocks for Elementor
≤1.5.2.1Update to 1.5.2.2
- Medium5.3Missing Authorization
Scripts n Styles
≤3.5.8No patch available
- Medium4.3Missing Authorization
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.4.1Update to 3.4.2
- Medium5.3Missing Authorization
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
All Bootstrap Blocks
≤1.3.31No patch available
- Medium4.3Missing Authorization
Before After Image Comparison – Visual Comparison for Two Images
≤1.1.21Update to 1.1.22
- Critical9.8Unauthenticated Privilege Escalation
Tonda Membership
≤1.0.1No patch available
- Medium4.3Missing Authorization
Asgaros Forum
≤3.4.0No patch available
- Medium5.3Unauthenticated Denial of Service
WooCommerce Bookings
≤3.10.0Update to 3.11.0
- Medium4.9Authenticated (Admin+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
<4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Mobile builder
≤1.4.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Prenotazioni
≤1.7.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Piotnet Forms
≤1.0.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe to Comments
≤2.3.2Update to 2.3.3
- High7.5Unauthenticated SQL Injection
paymendo – Bank Transfer (Lite)
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP Verify API
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
ASPL Product Quotation
≤1.1.0No patch available
- High7.5Unauthenticated SQL Injection
WpCues Basic Quiz
≤1.6.5No patch available
- High7.5Unauthenticated SQL Injection
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Topcontent
≤1.2.1No patch available
- Low3.1Information Exposure
Simple Membership
≤4.8.2Update to 4.8.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Web Vitals Tracking
≤5.4.2No patch available
- High8.8Authenticated (Crowdfundly Manager+) Privilege Escalation
Crowdfundly
≤2.2.2No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Freeton WP
≤1.0.0No patch available