CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1305)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1305)
Severity	Vulnerability	CVE	Installs	Published
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5672	—	Jan 11, 2018
High8.8	Cross-Site Request Forgery SrbTransLatin – Serbian Latinisation≤1.46Update to 1.47	CVE-2018-5368	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[more_languages] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5366	—	Jan 11, 2018
High8.8	Cross-Site Request Forgery WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5361	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5670	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[post_type][page] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5362	—	Jan 11, 2018
High8.8	SQL Injection Dbox 3D Slider Lite≤1.2.2Update to 1.2.3	CVE-2018-5374	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting SrbTransLatin – Serbian Latinisation≤1.46Update to 1.47	CVE-2018-5369	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5671	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5364	—	Jan 11, 2018
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5365	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[enabled_languages] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5363	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[post_type][post] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5367	—	Jan 11, 2018
High8.8	Authenticated SQL Injection Smooth Slider<2.8.7Update to 2.8.7	CVE-2018-5373	—	Jan 10, 2018
High8.8	SQL Injection Testimonial Slider<1.2.5Update to 1.2.5	CVE-2018-5372	—	Jan 10, 2018
Critical9.8	SQL Injection WP Events Calendar Plugin≤1.0Update to 1.1	CVE-2018-5315	—	Jan 9, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5288	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5289	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5293	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5286	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5292	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5291	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5290	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5287	—	Jan 8, 2018
High7.2	SQL Injection WP Job Board<4.5Update to 4.5	CVE-2018-5695	—	Jan 6, 2018
High7.5	Arbitrary File Upload LearnDash LMS<2.5.4Update to 2.5.4	CVE-2018-25019	—	Jan 6, 2018
Medium5.4	Stored Cross-Site Scripting Add Link to Facebook≤2.3No patch available	CVE-2018-5214	—	Jan 4, 2018
Medium6.1	Cross-Site Scripting ImageInject≤1.15Update to 1.16	CVE-2018-5284	—	Jan 4, 2018
High8.8	Cross-Site Request Forgery ImageInject≤1.15Update to 1.16	CVE-2018-5285	—	Jan 4, 2018
Medium6.3	Unauthenticated SQL Injection NebulaX Theme<5.0Update to 5.0	CVE-2018-25106	—	Jan 4, 2018

Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5672Jan 11, 2018
High8.8
Cross-Site Request Forgery
SrbTransLatin – Serbian Latinisation
≤1.46Update to 1.47
CVE-2018-5368Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[more_languages]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5366Jan 11, 2018
High8.8
Cross-Site Request Forgery
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5361Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5670Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[post_type][page]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5362Jan 11, 2018
High8.8
SQL Injection
Dbox 3D Slider Lite
≤1.2.2Update to 1.2.3
CVE-2018-5374Jan 11, 2018
Medium4.8
Cross-Site Scripting
SrbTransLatin – Serbian Latinisation
≤1.46Update to 1.47
CVE-2018-5369Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5671Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5364Jan 11, 2018
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5365Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[enabled_languages]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5363Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[post_type][post]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5367Jan 11, 2018
High8.8
Authenticated SQL Injection
Smooth Slider
<2.8.7Update to 2.8.7
CVE-2018-5373Jan 10, 2018
High8.8
SQL Injection
Testimonial Slider
<1.2.5Update to 1.2.5
CVE-2018-5372Jan 10, 2018
Critical9.8
SQL Injection
WP Events Calendar Plugin
≤1.0Update to 1.1
CVE-2018-5315Jan 9, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5288Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5289Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5293Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5286Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5292Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5291Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5290Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5287Jan 8, 2018
High7.2
SQL Injection
WP Job Board
<4.5Update to 4.5
CVE-2018-5695Jan 6, 2018
High7.5
Arbitrary File Upload
LearnDash LMS
<2.5.4Update to 2.5.4
CVE-2018-25019Jan 6, 2018
Medium5.4
Stored Cross-Site Scripting
Add Link to Facebook
≤2.3No patch available
CVE-2018-5214Jan 4, 2018
Medium6.1
Cross-Site Scripting
ImageInject
≤1.15Update to 1.16
CVE-2018-5284Jan 4, 2018
High8.8
Cross-Site Request Forgery
ImageInject
≤1.15Update to 1.16
CVE-2018-5285Jan 4, 2018
Medium6.3
Unauthenticated SQL Injection
NebulaX Theme
<5.0Update to 5.0
CVE-2018-25106Jan 4, 2018