CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 88)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
ECPay Ecommerce for WooCommerce
≤1.1.2606090Update to 1.1.2610150
- Critical9.8Unauthenticated Arbitrary File Upload
Kognetiks Chatbot
≤2.4.9Update to 2.5.0
- High7.2Unauthenticated Server-Side Request Forgery
PDF Smart Viewer for Elementor
≤1.0.4No patch available
- Medium4.3Missing Authorization
Progress Planner
≤1.10.0Update to 1.10.1
- Medium5.3Missing Authorization
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.2.2Update to 1.2.3
- Medium6.1Reflected Cross-Site Scripting
Payflex Payment Gateway
≤2.7.1Update to 2.8.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.7Update to 5.2.8
- Medium4.3Missing Authorization
Advanced Partial Payment or Deposit for WooCommerce
≤4.0.1Update to 4.0.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.5Update to 10.31.6
- High7.5Unauthenticated Arbitrary File Read
Generate PDF using Contact Form 7
≤4.2.1Update to 4.2.2
- Critical9.8Unauthenticated Arbitrary File Upload
Zombify
≤1.7.7No patch available
- Medium5.3Missing Authorization
Sermon'e
≤1.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP User Frontend Pro
≤4.2.13No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Media folder
≤6.2.2No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Appointments
≤5.3.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.1Update to 9.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.2Update to 6.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Total Donations
≤2.0.5No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Lottery
≤2.2.9No patch available
- Medium6.1Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting
Progressify – All-in-One Progressive Web App (PWA)
≤1.6.0No patch available
- High8.1Unauthenticated PHP Object Injection
Haaken - Fashion Store WordPress Theme
≤1.5Update to 1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Payment
≤2.5.4Update to 2.5.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetReviews
≤3.1.2Update to 3.1.2.1
- High7.5Unauthenticated Arbitrary File Read
PDF for Contact Form 7 + Drag and Drop Template Builder
≤7.1.0Update to 7.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Sharing Plugin – Sassy Social Share
≤3.3.79No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.3Update to 2.9.4
- Medium6.1Reflected Cross-Site Scripting
Grand Restaurant WordPress
<7.0.11Update to 7.0.11
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP BASE Booking of Appointments, Services and Events
≤6.4.0Update to 6.5.0
- High7.5Authenticated (Contributor+) PHP Object Injection
VK Google Job Posting Manager
≤1.3.1Update to 1.3.2