CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1290)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2019-17386 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-14328 | — | |
| High7.2 | Unauthenticated HTML injection | CVE-2019-25145 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17385 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17384 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14313 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13572 | — | |
| Medium5.3 | Login Page Disclosure via 'action=rp' | CVE-2019-15825 | — | |
| Medium5.3 | Login Page Disclosure via 'action=confirmaction' | CVE-2019-15823 | — | |
| Medium5.3 | Login Page Disclosure via Referer Header | CVE-2019-15826 | — | |
| Critical9.8 | Directory Traversal | CVE-2019-15822 | — | |
| Medium5.3 | Login Page Disclosure via 'adminhash' | CVE-2019-15824 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2019-14945 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13569 | — | |
| Critical10.0 | OnionBuzz < 1.2.2 - SQL Injection | CVE-2019-14231 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14230 | — | |
| High7.5 | Local File Inclusion | CVE-2019-14205 | — | |
| High7.5 | Arbitrary File Deletion | CVE-2019-14206 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2019-12934 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-15827 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13575 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5993 | — | |
| Medium6.5 | Unauthenticated Settings Reset | CVE-2019-25139 | — | |
| High7.2 | Stored Cross Site Scripting | CVE-2019-25140 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5992 | — | |
| High8.8 | SQL Injection | CVE-2019-1010034 | — | |
| High8.8 | Authenticated Remote Code Execution | CVE-2019-15324 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-14364 | — | |
| High7.5 | Authenticated Path Traversal | CVE-2019-15323 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15828 | — |
- High8.8Cross-Site Request Forgery
Animate It!
≤2.3.5Update to 2.3.6
- High8.8Cross-Site Request Forgery
Simple Membership
<3.8.5Update to 3.8.5
- High7.2Unauthenticated HTML injection
Contact Form & SMTP Plugin for WordPress by PirateForms
<2.5.2Update to 2.5.2
- Medium6.1Cross-Site Scripting
Animate It!
≤2.3.5Update to 2.3.6
- Medium6.1Cross-Site Scripting
Animate It!
≤2.3.5Update to 2.3.6
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.31Update to 1.5.31
- Critical9.8SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
<5.6.0Update to 5.6.0
- Medium5.3Login Page Disclosure via 'action=rp'
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Medium5.3Login Page Disclosure via 'action=confirmaction'
WPS Hide Login
<1.5.3Update to 1.5.3
- Medium5.3Login Page Disclosure via Referer Header
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Critical9.8Directory Traversal
WPS Child Theme Generator
≤1.1Update to 1.2
- Medium5.3Login Page Disclosure via 'adminhash'
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Medium6.4Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.53Update to 2.0.54
- Critical9.8SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.1.7Update to 4.1.8
- Critical10.0OnionBuzz < 1.2.2 - SQL Injection
OnionBuzz
≤1.2.1Update to 1.2.2
- Critical9.8SQL Injection
OnionBuzz
<1.2.7Update to 1.2.7
- High7.5Local File Inclusion
Adaptive Images for WordPress
<0.6.67Update to 0.6.67
- High7.5Arbitrary File Deletion
Adaptive Images for WordPress
<0.6.67Update to 0.6.67
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WP Code Highlight.js
<0.6.3Update to 0.6.3
- Medium6.4Stored Cross-Site Scripting
OneSignal – Web Push Notifications
≤1.17.7Update to 1.17.8
- Critical9.8SQL Injection
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
<1.5.0Update to 1.5.0
- High8.8Cross-Site Request Forgery
Category Specific RSS feed Subscription
≤2.0Update to 2.1
- Medium6.5Unauthenticated Settings Reset
Coming Soon Page & Maintenance Mode
≤1.8.1Update to 1.8.2
- High7.2Stored Cross Site Scripting
Coming Soon Page & Maintenance Mode
<1.8.2Update to 1.8.2
- High8.8Cross-Site Request Forgery
WordPress Ultra Simple Paypal Shopping Cart
≤4.4Update to 4.5
- High8.8SQL Injection
WebLibrarian
≤3.5.4Update to 3.5.5
- High8.8Authenticated Remote Code Execution
Ad Inserter – Ad Manager & AdSense Ads
≤2.4.21Update to 2.4.22
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.1.6Update to 4.1.7
- High7.5Authenticated Path Traversal
Ad Inserter – Ad Manager & AdSense Ads
≤2.4.19Update to 2.4.20
- High8.8Cross-Site Request Forgery
One Click SSL
<1.4.7Update to 1.4.7