VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 97)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 97)
SeverityVulnerabilityCVEInstallsPublished
Medium5.34.3.0 - Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor2.2.1 – 4.3.0Update to 4.3.1
CVE-2026-86834—
High7.52.0.20 - Unauthenticated SQL Injection
Unlimited Elements for Elementor1.5.139 – 2.0.20Update to 2.0.21
CVE-2026-85568—
Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export≤9.1Update to 9.2
CVE-2026-80518—
Medium4.9Authenticated (Editor+) Arbitrary File Read
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO≤4.2.2Update to 4.2.3
CVE-2026-103293—
High7.1Authenticated (Admin+) Arbitrary Directory Deletion
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101889—
Medium5.3Unauthenticated Persistent Denial of Service
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101160—
High7.2Unauthenticated Stored Cross-Site Scripting
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101159—
Medium5.3Missing Authorization
Mailchimp for WooCommerce≤6.2Update to 6.3
CVE-2026-92437—
Medium6.4Authenticated (Translator+) Stored Cross-Site Scripting
Loco Translate≤2.8.8Update to 2.8.9
CVE-2026-94239—
High7.5Unauthenticated SQL Injection
SaveTo Wishlist Lite – WooCommerce Wishlist≤1.1.4Update to 1.1.5
CVE-2026-89236—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kubio AI Page Builder≤2.9.2Update to 2.9.3
CVE-2026-88782—
Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Emails
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤4.3.0Update to 4.3.1
CVE-2026-86833—
High7.2Authenticated (Admin+) Arbitrary File Write
Unlimited Elements for Elementor≤2.0.20Update to 2.0.21
CVE-2026-85015—
Medium4.49.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export7.17 – 9.1Update to 9.2
CVE-2026-80517—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Horizontal scrolling announcements≤2.6No patch available
CVE-2026-17005—
Medium4.3Unauthenticated Two-Factor Authentication Bypass
WP 2FA – Two-factor authentication for WordPress≤4.0.0Update to 4.1.0
CVE-2026-103514—
High7.3Unauthenticated Captcha Verification Bypass
hCaptcha for WP≤5.3.0Update to 5.4.0
CVE-2026-103347—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101890—
High8.8Authenticated (Admin+) Arbitrary File Upload
Prime Mover – Backup and Migration≤2.2.0Update to 2.2.1
CVE-2026-101888—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Ultimate Review≤2.4.3Update to 2.4.4
CVE-2026-101162—
High7.2Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.2.1
CVE-2026-92144—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns≤6.4.5Update to 6.4.6
CVE-2026-96256—
Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19
CVE-2026-89427—
High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.2.1
CVE-2026-85235—
High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
PDF Invoices & Packing Slips for WooCommerce≤5.16.1Update to 5.16.2
CVE-2026-92244—
High7.2Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
Business Essentials for Contact Form 7≤1.2.1Update to 1.2.2
CVE-2026-97661—
High8.1Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Super Forms – Drag & Drop Form Builder≤6.3.316Update to 6.3.317
CVE-2026-15983—
Medium4.7Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤5.5.1.3Update to 5.5.1.4
CVE-2026-100184—
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤5.5.1.3Update to 5.5.1.4
CVE-2026-100179—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
bbp style pack≤6.4.8Update to 6.4.9
CVE-2026-101925—

Search VulnCrest Radar

Jump to

Are you sure?