VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1299)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1299)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Cross-Site Scripting via rules[0][content] parameter
WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6
CVE-2018-17586—
Medium6.1Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter
WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6
CVE-2018-17585—
High7.2Unauthenticated Stored Cross-Site Scripting
WPML Multilingual CMS≤3.6.3Update to 4.0
CVE-2018-18069—
Medium6.1Multiple Cross-Site Scripting vulnerabilities
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.0.27Update to 2.0.28
CVE-2018-17866—
Medium6.1Cross-Site Scripting
Slideshow Gallery LITE≤1.6.8Update to 1.6.9
CVE-2018-18019—
High7.2SQL Injection
Slideshow Gallery LITE≤1.6.8Update to 1.6.9
CVE-2018-18018—
Medium6.1Cross-Site Scripting
Slideshow Gallery LITE≤1.6.8Update to 1.6.9
CVE-2018-18017—
High8.8Cross-Site Request Forgery
Companion Auto Update<3.2.1Update to 3.2.1
CVE-2018-20972—
Critical9.8Local File Inclusion
Companion Auto Update<3.2.1Update to 3.2.1
CVE-2018-20973—
Medium6.1Stored Cross-Site Scripting
WebARX≤1.3.0No patch available
CVE-2019-17213—
Critical9.8Arbitrary File Upload
Wp-Insert≤2.4.2Update to 2.4.3
CVE-2018-17573—
High7.5Firewall Bypass
WebARX≤1.3.0No patch available
CVE-2019-17214—
Critical9.8Directory Traversal
微信群发助手-Wechat Broadcast≤1.2.0No patch available
CVE-2018-16283—
High7.5Directory Traversal
Localize My Post≤1.0No patch available
CVE-2018-16299—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002007—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002001—
Medium4.8Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002005—
Medium4.8Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002006—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002008—
High7.2SQL Injection
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002000—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002002—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002003—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002004—
Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002009—
Medium6.1Stored Cross-Site Scripting
File Manager≤3.0Update to 3.1
CVE-2018-169671M+
High8.8Cross-Site Request Forgery
File Manager≤3.0Update to 3.1
CVE-2018-169661M+
Critical9.8Unauthenticated Arbitrary File Upload/Download
File Manager≤3.0Update to 3.1
CVE-2018-251051M+
Medium6.1Reflected Cross-Site Scripting
File Manager<3.0Update to 3.0
CVE-2018-163631M+
High7.5PHAR Unserialization
WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-1000773—
Critical9.8Privilege Escalation
wpForo Forum≤1.5.1Update to 1.5.2
CVE-2018-16613—

Search VulnCrest Radar

Jump to

Are you sure?