VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1248)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1248)
SeverityVulnerabilityCVEInstallsPublished
Medium6.8Block Editor Authorization Bypass
WordPress5.8 beta 1 – 5.8 beta 1Update to 5.8
CVE-2021-39203—
Medium6.1LoDash Update
WordPress<5.8.1Update to 5.4.7 or 5.5.6 or 5.6.5 or 5.7.3 or 5.8.1
CVE-2020-8203—
Medium6.1On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting
On Page SEO + Social Live Chat≤1.0.1Update to 1.0.2
CVE-2021-38332—
Medium6.1YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting
YouTube Video Inserter≤1.2.1.0No patch available
CVE-2021-38327—
Medium6.1Reflected Cross-Site Scripting
Woocommerce Payment Gateway per Category≤2.0.10No patch available
CVE-2021-38341—
Medium6.1Reflected Cross-Site Scripting
OSD Subscribe≤1.2.3No patch available
CVE-2021-38351—
Medium6.1Reflected Cross-Site Scripting
Twitter Friends Widget≤3.1No patch available
CVE-2021-38322—
Medium6.1Reflected Cross-Site Scripting
simpleSAMLphp Authentication≤0.7.0No patch available
CVE-2021-38320—
Medium6.1Reflected Cross-Site Scripting
Custom Menu Plugin≤1.3.3No patch available
CVE-2021-38321—
Medium6.1Reflected Cross-Site Scripting
3D Cover Carousel≤1.0No patch available
CVE-2021-38318—
Medium6.1Reflected Cross-Site Scripting
RentPress≤6.6.4No patch available
CVE-2021-38323—
Medium5.5Authenticated Stored Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator<8.1.13Update to 8.1.13
CVE-2021-36870—
Medium6.1Reflected Cross-Site Scripting
WP Academic People List≤0.4.1No patch available
CVE-2021-38316—
Medium6.1Reflected Cross-Site Scripting
More from Google≤0.0.2No patch available
CVE-2021-38319—
High8.2Unauthenticated SQL Injection
SP Rental Manager≤1.5.3No patch available
CVE-2021-38324—
Medium6.1Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting
Konnichiwa! Membership≤0.8.3No patch available
CVE-2021-38317—
Medium5.5Authenticated Stored Cross-Site Scripting
WP Google Maps Pro≤8.1.11Update to 8.1.12
CVE-2021-36871—
Medium6.1Reflected Cross-Site Scripting
User Activation Email≤1.3.0No patch available
CVE-2021-38325—
High8.8Cross-Site Request Forgery
Weather Effect<1.3.4Update to 1.3.4
CVE-2021-24683—
Medium5.4Cross-Site Scripting
Chained Quiz<1.2.7.2Update to 1.2.7.2
CVE-2021-24690—
High8.8Missing Authorization
Share, Print and PDF Products for WooCommerce<2.8.0Update to 2.8.0
CVE-2021-4337—
Medium4.8Stored Cross-Site Scripting
Weather Effect≤1.3.5Update to 1.3.6
CVE-2021-24709—
Medium4.8Admin+ Stored Cross Site Scripting
WP Sitemap Page<1.7.0Update to 1.7.0
CVE-2021-24715—
Critical9.8Unuathenticated Arbitrary Options Update
Pinterest Automatic≤4.14.3Update to 4.14.4
CVE-2021-4380—
Medium4.8Admin+ Stored Cross-Site Scripting
Modern Events Calendar Lite≤5.22.1Update to 5.22.2
CVE-2021-24687—
Critical9.1Unauthenticated Arbitrary Options Update
WordPress Automatic Plugin<3.53.3Update to 3.53.3
CVE-2021-4374—
Medium5.4Authenticated Stored Cross-Site Scripting
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory<2.0.2Update to 2.0.2
CVE-2021-24654—
Medium5.5Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting
Appointment Hour Booking – Booking Calendar<1.3.16Update to 1.3.16
CVE-2021-24673—
Medium6.1Reflected Cross-Site Scripting
Better Find and Replace – AI-Powered Suggestions≤1.2.8Update to 1.2.9
CVE-2021-24676—
Medium5.4Authenticated Stored Cross-Site Scripting
CM Tooltip Glossary<3.9.21Update to 3.9.21
CVE-2021-24678—

Search VulnCrest Radar

Jump to

Are you sure?