VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1297)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1297)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant<3.3.0Update to 3.3.0
CVE-2019-1000003—
Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia≤0.1.0No patch available
CVE-2018-25436—
Critical9.8Arbitrary File Upload
Audio Record≤1.0No patch available
CVE-2024-51792—
Medium6.1Cross-Site Scripting
JSmol2WP≤1.07No patch available
CVE-2018-20462—
Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.21.1Update to 3.3.21.2
CVE-2019-15025—
High8.8SQL injection
Booking Calendar≤8.4.3Update to 8.4.4
CVE-2018-20556—
Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google≤4.0.9Update to 4.1.0
CVE-2018-16204—
High7.5Server-Side Request Forgery
JSmol2WP≤1.07No patch available
CVE-2018-20463—
High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export<1.4.2Update to 1.4.2
CVE-2018-20968—
High8.8Cross-Site Request Forgery
Two Factor Authentication<1.3.13Update to 1.3.13
CVE-2018-20231—
Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder<2.0.7Update to 2.0.7
CVE-2018-20156—
Medium5.5Cross-Site Scripting
Read and Understood<2.2Update to 2.2
CVE-2018-5668—
Medium6.4Authenticated Stored Cross-Site Scripting via Comments
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20153—
High7.7 Arbitrary File Deletion
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20147—
Medium6.4Stored Cross-Site Scripting via File Uploads
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20149—
High8.8PHP Object Injection
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20148—
Medium4.3Authorization Bypass
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20152—
High7.5Sensitive Information Disclosure
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20151—
Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-20150—
Medium6.1Import Cross-Site Scripting
Import and export users and customers<1.12.1Update to 1.12.1
CVE-2018-20101—
High7.5Arbitrary File Read
WebP Express<0.14.11Update to 0.14.11
CVE-2019-15330—
Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)<5.7.8Update to 5.7.8
CVE-2018-20986—
Critical9.8Local File Inclusion
WP Payeezy Pay<2.98Update to 2.98
CVE-2018-20985—
High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer<1.1.16Update to 1.1.16
CVE-2019-15872—
Medium5.3User Enumeration
WP JobHunt<2.4Update to 2.4
CVE-2018-19487—
High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt<2.4Update to 2.4
CVE-2018-19488—
Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.19Update to 3.3.19.1
CVE-2018-19796—
Critical9.8Improper Access Control
User Email Verification for WooCommerce≤3.1.15Update to 3.2.0
CVE-2018-21007—
Medium6.1Stored Cross-Site Scripting
Easy Testimonials<3.6Update to 3.6
CVE-2018-19564—
Critical9.8PHP Object Injection
Patreon WordPress<1.2.2Update to 1.2.2
CVE-2018-20984—
  • Medium6.1
    Cross-Site Request Forgery

    MapSVG – Vector maps, Google Maps, Image maps – with AI assistant

    <3.3.0Update to 3.3.0

    CVE-2019-1000003

  • Critical9.8
    Arbitrary File Upload

    Baggage Freight Shipping Australia

    ≤0.1.0No patch available

    CVE-2018-25436

  • Critical9.8
    Arbitrary File Upload

    Audio Record

    ≤1.0No patch available

    CVE-2024-51792

  • Medium6.1
    Cross-Site Scripting

    JSmol2WP

    ≤1.07No patch available

    CVE-2018-20462

  • Critical9.8
    SQL Injection

    Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    ≤3.3.21.1Update to 3.3.21.2

    CVE-2019-15025

  • High8.8
    SQL injection

    Booking Calendar

    ≤8.4.3Update to 8.4.4

    CVE-2018-20556

  • Medium5.5
    Authenticated Cross-Site Scripting

    XML Sitemap Generator for Google

    ≤4.0.9Update to 4.1.0

    CVE-2018-16204

  • High7.5
    Server-Side Request Forgery

    JSmol2WP

    ≤1.07No patch available

    CVE-2018-20463

  • High8.8
    Cross-Site Request Forgery

    Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export

    <1.4.2Update to 1.4.2

    CVE-2018-20968

  • High8.8
    Cross-Site Request Forgery

    Two Factor Authentication

    <1.3.13Update to 1.3.13

    CVE-2018-20231

  • Critical9.1
    Remote Code Execution

    LightStart – Maintenance Mode, Coming Soon and Landing Page Builder

    <2.0.7Update to 2.0.7

    CVE-2018-20156

  • Medium5.5
    Cross-Site Scripting

    Read and Understood

    <2.2Update to 2.2

    CVE-2018-5668

  • Medium6.4
    Authenticated Stored Cross-Site Scripting via Comments

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20153

  • High7.7
    Arbitrary File Deletion

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20147

  • Medium6.4
    Stored Cross-Site Scripting via File Uploads

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20149

  • High8.8
    PHP Object Injection

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20148

  • Medium4.3
    Authorization Bypass

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20152

  • High7.5
    Sensitive Information Disclosure

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20151

  • Medium6.1
    WordPress Core < 5.0.1 Reflected Cross-Site Scripting

    WordPress

    ≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1

    CVE-2018-20150

  • Medium6.1
    Import Cross-Site Scripting

    Import and export users and customers

    <1.12.1Update to 1.12.1

    CVE-2018-20101

  • High7.5
    Arbitrary File Read

    WebP Express

    <0.14.11Update to 0.14.11

    CVE-2019-15330

  • Medium5.4
    Author+ Stored Cross-Site Scripting

    Advanced Custom Fields (ACF®)

    <5.7.8Update to 5.7.8

    CVE-2018-20986

  • Critical9.8
    Local File Inclusion

    WP Payeezy Pay

    <2.98Update to 2.98

    CVE-2018-20985

  • High8.8
    Authenticated SQL Injection via Settings Import

    LoginPress | wp-login Custom Login Page Customizer

    <1.1.16Update to 1.1.16

    CVE-2019-15872

  • Medium5.3
    User Enumeration

    WP JobHunt

    <2.4Update to 2.4

    CVE-2018-19487

  • High8.8
    Unauthenticated Arbitrary Password Reset

    WP JobHunt

    <2.4Update to 2.4

    CVE-2018-19488

  • Medium4.7
    Authenticated Open Redirect

    Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    ≤3.3.19Update to 3.3.19.1

    CVE-2018-19796

  • Critical9.8
    Improper Access Control

    User Email Verification for WooCommerce

    ≤3.1.15Update to 3.2.0

    CVE-2018-21007

  • Medium6.1
    Stored Cross-Site Scripting

    Easy Testimonials

    <3.6Update to 3.6

    CVE-2018-19564

  • Critical9.8
    PHP Object Injection

    Patreon WordPress

    <1.2.2Update to 1.2.2

    CVE-2018-20984

Search VulnCrest Radar

Jump to

Are you sure?