CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1314)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2017-18544 | — | |
| High7.5 | Improper Input Validation | CVE-2017-18545 | — | |
| High7.5 | Email Injection | CVE-2017-18543 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18571 | — | |
| High8.8 | SQL Injection | CVE-2017-1002010 | — | |
| Medium5.3 | Change of Email Invitation Content | CVE-2017-6955 | — | |
| Medium4.3 | Authorization Bypass | CVE-2017-6954 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002009 | — | |
| High7.5 | Missing Authorization | CVE-2017-1002006 | — | |
| Critical9.8 | Arbitrary File Download | CVE-2017-1002008 | — | |
| High7.2 | SQL Injection via subscriber_email parameter | CVE-2017-6578 | — | |
| Critical9.8 | SQL Injection | CVE-2017-20247 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002005 | — | |
| High7.5 | Authorization Bypass | CVE-2017-1002007 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002004 | — | |
| Medium6.1 | HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31 | CVE-2017-18574 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002001 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002003 | — | |
| High8.8 | Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6819 | — | |
| Medium6.4 | Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6818 | — | |
| Medium6.1 | Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6815 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6817 | — | |
| Medium6.4 | Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6814 | — | |
| Medium4.9 | Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6816 | — | |
| High7.2 | SQL Injection via id parameter | CVE-2017-6576 | — | |
| High7.2 | SQL Injection via filter_list | CVE-2017-6574 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-6102 | — | |
| Critical9.8 | Security Bypass to Database Login | CVE-2017-20066 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-20054 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-20090 | — |
- High8.8Cross-Site Request Forgery
Invite Anyone
<1.3.16Update to 1.3.16
- High7.5Improper Input Validation
Invite Anyone
≤1.3.15Update to 1.3.16
- High7.5Email Injection
Invite Anyone
<1.3.16Update to 1.3.16
- Critical9.8SQL Injection
Search Everything
≤8.1.6Update to 8.1.7
- High8.8SQL Injection
Membership Simplified
<1.58Update to 1.58
- Medium5.3Change of Email Invitation Content
Invite Anyone
<1.3.15Update to 1.3.15
- Medium4.3Authorization Bypass
BuddyPress Docs
<1.9.3Update to 1.9.3
- Critical9.8SQL Injection
Membership Simplified
≤1.58No patch available
- High7.5Missing Authorization
DTracker
≤1.5No patch available
- Critical9.8Arbitrary File Download
Membership Simplified
≤1.58No patch available
- High7.2SQL Injection via subscriber_email parameter
Mail Masta
≤1.0No patch available
- Critical9.8SQL Injection
PICA Photo Gallery
≤1.0No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- High7.5Authorization Bypass
DTracker
≤1.5No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- Medium6.1HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
- Critical9.8Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
- Critical9.8Arbitrary File Upload
Wp2android
≤1.1.4No patch available
- High8.8Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.1Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium4.9Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High7.2SQL Injection via id parameter
Mail Masta
≤1.0No patch available
- High7.2SQL Injection via filter_list
Mail Masta
≤1.0No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
wordpress plugin rockhoist-badges
≤1.2.2No patch available
- Critical9.8Security Bypass to Database Login
adminer
≤1.4.5No patch available
- Medium6.1Cross-Site Scripting
Contact Form Manager
≤1.4.3Update to 1.4.4
- High8.8Cross-Site Request Forgery
Global Content Blocks
≤2.1.5No patch available