CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 95)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High7.5Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
SiteOrigin Widgets Bundle
≤1.73.2Update to 1.74.0
- Critical9.1Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.8Unauthenticated Authentication Bypass via 'paypal_param' Parameter
Divi Membership
≤2.3.0Update to 3.0.0
- Critical9.8Unauthenticated Privilege Escalation via 'form_id' Parameter
Divi Membership
≤2.2.0Update to 2.3.0
- High7.2Authenticated (Administrator+) Remote Code Execution
CTX Feed Pro
≤7.6.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
Visitor Traffic Real Time Statistics pro
≤11.22Update to 11.23
- Critical9.8Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
DevKit Pro
≤2.3.0Update to 2.3.1
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Critical9.8Unauthenticated Remote Code Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
ByteCoreStack – MCP Connector for AI Tools
≤1.2.2Update to 1.2.4
- High7.3Unauthenticated Privilege Escalation
Authorizer
≤3.15.3Update to 3.16.0
- Medium4.3Missing Authorization
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤4.0.7Update to 4.1.0
- Medium4.3Missing Authorization
Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more
≤3.6.2Update to 3.7.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Bus Ticket Booking with Seat Reservation
≤5.9.3Update to 5.9.4
- Medium4.3Missing Authorization
Aruba Migration Tool
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Wishlist for WooCommerce
≤1.1.13Update to 1.1.15
- Medium5.3Unauthenticated Information Exposure
CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)
≤3.7.2Update to 3.8.0
- Medium4.9Authenticated (Editor+) SQL Injection
Captivate Sync
≤3.3.2Update to 3.3.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- Medium4.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.4Update to 6.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Information Exposure
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.13Update to 3.8.4.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.6Update to 4.0.7
- Medium6.5Authenticated (Contributor+) SQL Injection
BuildKit – Product Builder for WooCommerce – Custom PC Builder
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.6Update to 4.0.7
- Medium5.3Missing Authorization
AFFI – Affiliate Marketing for WooCommerce
≤1.0.9Update to 1.0.10