VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1244)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1244)
SeverityVulnerabilityCVEInstallsPublished
Medium4.33.3.9 - Missing Authorization Controls to Financial Account Hijacking
Stripe for WooCommerce3.0.0 – 3.3.9Update to 3.3.10
CVE-2021-39347—
Medium6.1Reflected Cross-Site Scripting
Ivory Search – WordPress Search Plugin≤4.6.6Update to 4.7
CVE-2021-36869—
Medium5.3Sensitive Information Disclosure
Credova Financial≤1.4.8Update to 1.4.9
CVE-2021-39342—
Medium5.5Admin+ Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher<2.6.12Update to 2.6.12
CVE-2021-24793—
Critical9.8Arbitrary Image Upload
Stylish Price List – Price Table Builder & QR Code Restaurant Menu<6.9.0Update to 6.9.0
CVE-2021-24757—
Medium6.5Missing Authorization
Stylish Price List – Price Table Builder & QR Code Restaurant Menu≤6.9.0Update to 6.9.1
CVE-2021-24770—
Medium5.5Cross-Site Scripting
Download Manager<3.2.16Update to 3.2.16
CVE-2021-24773—
Medium5.4Authenticated Stored Cross Site Scripting
Modern Events Calendar Lite≤5.22.2Update to 5.22.3
CVE-2021-24716—
Medium5.5Admin+ Stored Cross-Site Scripting
Connections Business Directory<10.4.3Update to 10.4.3
CVE-2021-24794—
Medium5.5Stored Cross-Site Scripting
Flat Preloader<1.5.5Update to 1.5.5
CVE-2021-24789—
Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
Flat Preloader<1.5.4Update to 1.5.4
CVE-2021-24685—
Medium5.5Admin+ Stored Cross Site Scripting
Restaurant Menu and Food Ordering<2.4.2Update to 2.4.2
CVE-2021-24722—
High8.8Privilege Escalation
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI<1.7.6Update to 1.7.6
CVE-2021-24717—
High8.8Cross-Site Request Forgery
OG Tags≤2.0.1Update to 2.0.2
CVE-2021-20831—
Medium6.4Contributor+ Stored Cross-Site Scripting
Cool Tag Cloud≤2.25Update to 2.26
CVE-2021-24682—
Medium5.4Cross-Site Scripting
WP Reactions Lite<1.3.6Update to 1.3.6
CVE-2021-24723—
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Countdown and CountUp, WooCommerce Sales Timer≤1.5.7Update to 1.5.8
CVE-2021-34636—
Medium4.9Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read
Contact Forms – Drag & Drop Contact Form Builder≤1.0.5No patch available
CVE-2021-24689—
Medium5.5Cross-Site Scripting
Contact Forms by Cimatti<1.4.12Update to 1.4.12
CVE-2021-24744—
High7.2Admin+ SQL Injection
Permalink Manager Lite≤2.2.12Update to 2.2.13.1
CVE-2021-24769—
Medium4.8Admin+ Stored Cross-Site Scripting
Visual Form Builder≤3.0.3Update to 3.0.4
CVE-2021-24514—
Medium6.5Unauthenticated Plugin Settings Update
WP Debugging≤2.10.2Update to 2.11.0
CVE-2021-24779—
High7.2Admin+ SQL Injection via Order and OrderBy parameters
Check & Log Email – Easy Email Testing & Mail logging≤1.0.2Update to 1.0.3
CVE-2021-24774—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Great Quotes≤1.0.0No patch available
CVE-2021-24785—
Medium4.8Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.5.8.2Update to 3.5.8.2
CVE-2021-24381—
High7.2Unauthenticated Stored Cross-Site Scripting
WP DSGVO Tools (GDPR)<3.1.24Update to 3.1.24
CVE-2021-4358—
High7.2iframe Injection
ark-commenteditor≤2.15.6No patch available
CVE-2021-4227—
Critical9.8Arbitrary File Upload
3DPrint Lite<1.9.1.5Update to 1.9.1.5
CVE-2021-4436—
Medium6.6Authenticated Stored Cross-Site Scripting
AGCA – Custom Dashboard & Login Page≤6.8Update to 6.9
CVE-2021-36823—
Medium6.9Multiple Authenticated Stored Cross-Site Scripting
YITH Maintenance Mode≤1.3.8Update to 1.4.0
CVE-2021-36845—

Search VulnCrest Radar

Jump to

Are you sure?