CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 96)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium4.3Missing Authorization
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program
≤4.6.3Update to 4.6.4
- Medium5.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium5.3Missing Authorization
Site Reviews
≤8.3.2Update to 8.3.3
- Medium6.5Authenticated (Contributor+) SQL Injection
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium4.3Cross-Site Request Forgery
Memberful – Membership Plugin
≤1.81.0Update to 1.81.1
- High7.2Unauthenticated Stored Cross-Site Scripting
MaxGalleria
≤6.5.3Update to 6.5.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
REST API Log
≤1.7.2Update to 1.7.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Parallax Section Block – Add Parallax Scrolling Effects to Sections
≤2.0.4Update to 2.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Wishlist for WooCommerce
≤1.1.13Update to 1.1.15
- Medium5.3Missing Authorization
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.5.6Update to 8.5.7
- Medium5.3Missing Authorization
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
3.1.0 – 3.1.0Update to 3.1.1
- Medium6.6Authenticated (Editor+) PHP Object Injection
Hide Shipping Method For WooCommerce
≤1.5.4Update to 1.5.5
- High7.5Authenticated (Contributor+) PHP Object Injection
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤3.1.31Update to 3.1.44
- Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.1Update to 9.2
- High7.5Unauthenticated SQL Injection
Iptanus File Upload
≤5.1.10Update to 5.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
LA-Studio Element Kit for Elementor
≤1.6.2Update to 1.6.3
- Medium5.3Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Persistent Page Denial of Service
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.3Unauthenticated Information Exposure
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.13Update to 3.8.4.14
- Critical9.1Unauthenticated Arbitrary File Deletion
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.5Update to 11.1.0
- Medium4.3Authenticated (Translator+) Limited File Read
Loco Translate
≤2.8.8Update to 2.8.9
- Medium6.52.0.20 - Authenticated (Subscriber+) SQL Injection
Unlimited Elements for Elementor
1.5.142 – 2.0.20Update to 2.0.21
- Medium5.3Unauthenticated Privileged POS Session Hijacking
TillKit – Mobile POS for WooCommerce
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.2Update to 2.9.3