CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1317)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10871 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15033 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10944 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10736 | — | |
| High8.3 | Server Side Request Forgery | CVE-2016-10926 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2016-10112 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2243 | — | |
| Medium5.3 | Local File Inclusion | CVE-2016-20064 | — | |
| Critical9.8 | SQL Injection | CVE-2016-20065 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10945 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-1000013 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10904 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10946 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-1000033 | — | |
| High7.2 | Authenticated (Super Admin+) SQL Injection | CVE-2016-10947 | — | |
| High8.8 | SQL Injection | CVE-2016-10949 | — | |
| High8.1 | PHP Object Injection | CVE-2016-10948 | — | |
| Critical9.8 | SQL Injection | CVE-2016-20072 | — | |
| Critical9.8 | Authenticated Local File Inclusion & SQL injection | CVE-2016-10889 | — | |
| High7.5 | Remote File Inclusion | CVE-2016-6565 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10934 | — | |
| Critical9.8 | SQL Injection | CVE-2016-20073 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10866 | — | |
| High7.2 | SQL Injection | CVE-2016-10951 | — | |
| High8.8 | SQL Injection | CVE-2016-10950 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10952 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10919 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10903 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000145 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000151 | — |
- Medium6.1Reflected Cross-Site Scripting
MC4WP: Mailchimp for WordPress
<4.0.11Update to 4.0.11
- Critical9.8Arbitrary File Upload
Delete All Comments
≤2.0No patch available
- High8.8Cross-Site Request Forgery
Multisite Post Duplicator
≤1.7.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.2.5Update to 1.2.6
- High8.3Server Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.5.8Update to 4.5.9
- Medium5.5Authenticated Stored Cross-Site Scripting
WooCommerce
<2.6.9Update to 2.6.9
- Medium6.1Cross-Site Scripting
Responsive Lightbox & Gallery
≤1.7.1Update to 1.7.2
- Medium5.3Local File Inclusion
WP Vault
≤0.8.6.6No patch available
- Critical9.8SQL Injection
product-catalog-8
≤1.2.0No patch available
- High8.8Cross-Site Request Forgery
Platform
≤1.1.4No patch available
- Critical9.8Arbitrary File Upload
Csv2WPeC Coupon
≤1.1No patch available
- Critical9.8SQL Injection
Olimometer
<2.57Update to 2.57
- High8.8Cross-Site Request Forgery
Wp-D3
<2.4.1Update to 2.4.1
- Medium6.1Reflected Cross-Site Scripting
Vospari Forms
<1.4Update to 1.4
- High7.2Authenticated (Super Admin+) SQL Injection
Post Indexer
<3.0.6.2Update to 3.0.6.2
- High8.8SQL Injection
Relevanssi Premium
<1.14.6.1Update to 1.14.6.1
- High8.1PHP Object Injection
Post Indexer
<3.0.6.2Update to 3.0.6.2
- Critical9.8SQL Injection
BBS e-Franchise
<1.1.4Update to 1.1.4
- Critical9.8Authenticated Local File Inclusion & SQL injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.56Update to 2.1.57
- High7.5Remote File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.56Update to 2.1.57
- Medium6.1Reflected Cross-Site Scripting
Check & Log Email – Easy Email Testing & Mail logging
<0.5.2Update to 0.5.2
- Critical9.8SQL Injection
Answer My Question
≤1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.2.0Update to 4.2.0
- High7.2SQL Injection
FireStorm Shopping Cart eCommerce Plugin
≤2.07.02No patch available
- High8.8SQL Injection
Image Optimizer, Resizer and CDN – Sirv
<1.3.2Update to 1.3.2
- Medium6.1Cross-Site Scripting
Quotes Collection
<2.0.6Update to 2.0.6
- Medium6.1Cross-Site Scripting
WassUp Real Time Analytics
<1.9.1Update to 1.9.1
- High8.8Cross-Site Request Forgery
GoDaddy Email Marketing
<1.1.4Update to 1.1.4
- Medium6.1Reflected Cross-Site Scripting
Pondol Carousel
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Tera Charts
≤1.0No patch available