CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1311)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2017-18563 | — | |
| High8.8 | SQL Injection | CVE-2017-9603 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-1002017 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-9419 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-2195 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2017-9429 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9420 | — | |
| High8.8 | SQL Injection | CVE-2017-9418 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002018 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002019 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-15863 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18512 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002023 | — | |
| Critical9.8 | Authenticated SQL Injection | CVE-2017-1002020 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002022 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002021 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18522 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18523 | — | |
| Medium5.4 | Authorization Bypass Allowing Post Meta Updates WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9065 | — | |
| High8.8 | Cross-Site Request Forgery Filesystem Credential Update WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9064 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2168 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2187 | — | |
| High7.7 | Server-Side Request Forgery WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9066 | — | |
| Medium5.3 | User Enumeration | CVE-2017-1000226 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2169 | — | |
| Medium6.3 | Mishandling Post Meta Values via XML-RPC WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9062 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9063 | — | |
| Medium6.4 | Stored Cross-Site Scripting via filenames WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9061 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18578 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18547 | — |
- Medium6.1Cross-Site Scripting
RSVP and Event Management
<2.3.8Update to 2.3.8
- High8.8SQL Injection
WP Jobs
<1.5Update to 1.5
- High7.2Stored Cross-Site Scripting
Gift Certificate Creator
≤1.0Update to 1.1
- Medium6.1Cross-Site Scripting
WP Custom Fields Search
<1.0Update to 1.0
- High8.8Authenticated SQL Injection
Multi Feed Reader
≤2.2.3Update to 2.2.4
- High7.2Authenticated (Admin+) SQL Injection
Event List
<0.7.9Update to 0.7.9
- Medium6.1Reflected Cross-Site Scripting
Spiffy Calendar
<3.3.0Update to 3.3.0
- High8.8SQL Injection
WP-Testimonials
≤3.4.1No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Medium6.1Reflected Cross-Site Scripting
wp-noexternallinks
<3.5.19Update to 3.5.19
- High8.8Cross-Site Request Forgery
Newsletter by Supsystic
<1.1.8Update to 1.1.8
- Critical9.8SQL Injection
Easy Team Manager
≤1.3.2No patch available
- Critical9.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- High8.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- Critical9.8SQL Injection
surveys
≤1.01.8No patch available
- Medium6.1Cross-Site Scripting
EELV Newsletter
<4.6.1Update to 4.6.1
- High8.8Cross-Site Request Forgery
EELV Newsletter
≤4.6.0Update to 4.6.1
- Medium5.4Authorization Bypass Allowing Post Meta Updates
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- High8.8Cross-Site Request Forgery Filesystem Credential Update
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
WP Booking System – Booking Calendar
<1.4Update to 1.4
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.0.06Update to 7.0.07
- High7.7Server-Side Request Forgery
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.3User Enumeration
Stop User Enumeration
<1.3.9Update to 1.3.9
- Medium6.1Cross-Site Scripting
MaxButtons – Create buttons
≤6.18Update to 6.19
- Medium6.3Mishandling Post Meta Values via XML-RPC
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.4Stored Cross-Site Scripting via filenames
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
Crafty Social Buttons
<1.5.8Update to 1.5.8
- High8.8Cross-Site Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.6.4Update to 4.6.4