VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1294)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1294)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform<2.4.7Update to 2.4.7
CVE-2019-15317—
Medium4.9Authenticated Local File Inclusion
Photo Gallery by 10Web – Mobile-Friendly Image Gallery≤1.5.24Update to 1.5.25
CVE-2019-14798—
Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery≤1.5.22Update to 1.5.23
CVE-2019-14797—
High7.5Unauthenticated Arbitrary File Read
diarise≤1.5.9No patch available
CVE-2019-25779—
High8.8Authenticated SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder<1.13.3Update to 1.13.3
CVE-2019-10866—
Critical9.8Administrative User Creation
WPGraphQL≤0.2.3Update to 0.3.0
CVE-2019-9879—
Medium5.3Unauthenticated Comment Creation
WPGraphQL≤0.2.3Update to 0.3.0
CVE-2019-9881—
Medium5.4Authenticated Cross-Site Scripting
Custom Field Suite≤2.5.14Update to 2.5.15
CVE-2019-11871—
Critical9.1Information Exposure
WPGraphQL≤0.2.3Update to 0.3.0
CVE-2019-9880—
Medium6.1Cross-Site Scripting
Ultimate FAQ Accordion Plugin<1.8.22Update to 1.8.22
CVE-2019-15643—
High7.5Information Exposure
Gravity Forms≤2.4.8Update to 2.4.9
CVE-2020-13764—
Critical9.8PHP Object Injection
Virim≤0.4No patch available
CVE-2019-12240—
Critical9.8Arbitrary File Upload
wp-live-chat-support-pro≤8.0.26Update to 8.0.27
CVE-2019-11185—
Critical9.8PHP Object Injection
Carts Guru≤1.4.5Update to 1.4.6
CVE-2019-12241—
High7.5Sensitive Information Disclosure
WP Backup+≤2018-11-22No patch available
CVE-2018-19456—
Medium6.1Reflected Cross-Site Scripting
Blog2Social: Social Media Auto Post & Scheduler<5.0.3Update to 5.0.3
CVE-2019-9576—
Critical9.8Unauthenticated Arbitrary File Upload
User Submitted Posts – Enable Users to Submit Posts from the Front End<20190426Update to 20190426
CVE-2019-25138—
Medium6.1Unauthenticated Cross-Site Scripting
My Calendar – Accessible Event Manager≤3.1.9Update to 3.1.10
CVE-2019-15713—
Critical9.8SQL Injection
RSVPMaker≤6.1.9Update to 6.2
CVE-2019-15646—
Critical9.8Server-Side Request Forgery
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin≤1.6.6Update to 1.6.7
CVE-2019-11565—
High7.5Unauthenticated Arbitrary Media Deletion
Checkout Field Manager (Checkout Manager) for WooCommerce≤4.2.6Update to 4.3
CVE-2019-11807—
Medium6.4Stored Cross-Site Scripting
JobCareer | Job Board Responsive WordPress Theme<2.5.1Update to 2.5.1
CVE-2019-15869—
Critical9.8Unauthenticated OS Command Injection
WP Database Backup – Unlimited Database & Files Backup by Backup for WP<5.2Update to 5.2
CVE-2019-25224—
High8.8Cross-Site Request Forgery
WDContactFormBuilder<1.0.69Update to 1.0.69
CVE-2019-11557—
Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP≤5.1.1Update to 5.1.2
CVE-2019-14949—
Medium6.4Authenticated Stored Cross-Site Scripting
CarSpot – Dealership Wordpress Classified Theme<2.1.7Update to 2.1.7
CVE-2019-15870—
Critical9.8Arbitrary File Upload
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot<2.0.1Update to 2.0.1
CVE-2019-11223—
High8.1PHP Object Injection
OptionTree≤2.6.0Update to 2.7.0
CVE-2019-15319—
Medium6.1Reflected Cross-Site Scripting via URL parameter
MailPoet – Newsletters, Email Marketing, and Automation<3.23.2Update to 3.23.2
CVE-2019-11843—
Medium6.1Cross-Site Scripting
Download Manager<2.9.94Update to 2.9.94
CVE-2019-15889—

Search VulnCrest Radar

Jump to

Are you sure?