VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1266)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1266)
SeverityVulnerabilityCVEInstallsPublished
High8.8Cross-Site Request Forgery to Arbitrary Listing Export
Business Directory Plugin – Easy Listing & Member Directories for WordPress≤5.11.1Update to 5.11.2
CVE-2021-24249—
Medium6.5Cross-Site Request Forgery to Stored Cross-Site Scripting
Content Copy Protection & Prevent Image Save≤1.3No patch available
CVE-2021-24333—
High7.2Arbitrary File Upload
College publisher Import≤0.1No patch available
CVE-2021-24254—
High7.2Authenticated PHP4 Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress≤5.11Update to 5.11.1
CVE-2021-24248—
High8.8Cross-Site Request Forgery to Arbitrary File Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress≤5.10.1Update to 5.11
CVE-2021-24179—
High8.8Cross-Site Request Forgery
Business Directory Plugin – Easy Listing & Member Directories for WordPress≤5.11Update to 5.11.1
CVE-2021-24178—
Medium6.4Authenticated (Subscriber+) Cross-Site Scripting
Contact Form Check Tester≤1.0.2No patch available
CVE-2021-24247—
High7.2Cross-Site Request Forgery
Event Banner≤1.3No patch available
CVE-2021-24252—
High8.8Arbitrary File Upload
classyfrieds≤3.8No patch available
CVE-2021-24253—
Medium6.4Authenticated Stored Cross-Site Scripting
Larsens Calender≤1.2No patch available
CVE-2020-23762—
High8.8Cross-Site Request Forgery
Media File Renamer: Rename Images & Files for SEO (AI-Powered)≤5.2.5Update to 5.2.6
CVE-2021-36850—
High7.4Multiple Stored Cross-Site scripting
WP Page Builder<1.2.4Update to 1.2.4
CVE-2021-24208—
Medium5.4Insecure Default to Unauthorized Page Editing
WP Page Builder<1.2.4Update to 1.2.4
CVE-2021-24207—
Critical9.8Arbitrary File Upload
Imagements≤1.2.5No patch available
CVE-2021-24236—
Medium6.1Reflected Cross-Site Scripting
Stop Spammers Classic<2021.9Update to 2021.9
CVE-2021-24245—
Medium6.4Job Board WordPress Theme <= 2.0.31 - Stored Cross-Site Scripting
Workscout Core<1.3.4Update to 1.3.4
CVE-2021-24246—
Medium6.1Reflected Cross-Site Scripting
OpenID Connect Generic Client3.8.0 – <3.8.2Update to 3.8.2
CVE-2021-24214—
Medium6.5Arbitrary License Options Update
WPBakery Page Builder Clipboard<4.5.8Update to 4.5.8
CVE-2021-24244—
Medium5.5Authenticated Local File Inclusion
Tutor LMS – eLearning and online course solution≤1.8.7Update to 1.8.8
CVE-2021-24242—
Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction<3.7.0.1Update to 3.7.0.1
CVE-2021-24239—
Medium6.4Stored Cross-Site Scripting
WPBakery Page Builder Clipboard<4.5.6Update to 4.5.6
CVE-2021-24243—
Critical9.8Arbitrary File Upload
Business Hours Pro WordPress Plugin≤5.5.0No patch available
CVE-2021-24240—
Medium4.8Authenticated Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard≤3.5.8Update to 3.5.9
CVE-2021-24658—
Medium6.1Reflected Cross-Site Scripting
Realteo≤1.2.3Update to 1.2.4
CVE-2021-24237—
Critical9.9Privilege Escalation
Controlled Admin Access<1.5.6Update to 1.5.6
CVE-2021-4360—
Medium6.1Reflected Cross-Site Scripting
Cooked Pro<1.7.5.6Update to 1.7.5.6
CVE-2021-24233—
Medium6.1Reflected Cross-Site Scripting
Advanced Booking Calendar<1.6.8Update to 1.6.8
CVE-2021-24232—
Medium6.1Reflected Cross Site Scripting
Ivory Search – WordPress Search Plugin≤4.6Update to 4.6.1
CVE-2021-24234—
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Login Security and History≤1.0No patch available
CVE-2021-24328—
Medium5.5Authenticated Stored Cross-Site Scripting
Virtual Robots.txt≤1.9Update to 1.10
CVE-2021-28121—

Search VulnCrest Radar

Jump to

Are you sure?