VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1325)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1325)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<1.3.29Update to 1.3.29
CVE-2015-8354—
High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.64Update to 1.5.64
CVE-2015-9395—
Critical9.8SQL Injection
Google Doc Embedder<2.5.17Update to 2.5.17
CVE-2014-9173—
Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus≤1.9No patch available
CVE-2015-9396—
Medium6.1Reflected Cross-Site Scripting
Websimon Tables≤1.3.4No patch available
CVE-2015-9401—
High7.2Authenticated SQL Injection
WP-Stats-Dashboard≤2.9.4No patch available
CVE-2015-9399—
Critical9.8SQL Injection
Double Opt-In for Download<2.0.9Update to 2.0.9
CVE-2015-7517—
High7.2Authenticated (Admin+) SQL Injection
Watu Quiz≤2.6.7Update to 2.6.8
CVE-2015-10111—
High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.59Update to 1.5.59
CVE-2015-9402—
Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin<0.8.4.9Update to 0.8.4.9
CVE-2015-9316—
Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<2.2.5Update to 2.2.5
CVE-2015-9328—
High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)<1.1.5Update to 1.1.5
CVE-2016-10978—
Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)<1.1.5Update to 1.1.5
CVE-2016-10979—
Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll≤2.0No patch available
CVE-2015-9403—
Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll≤2.0No patch available
CVE-2015-9404—
Critical9.0Remote File Inclusion
Gwolle Guestbook<1.5.4Update to 1.5.4
CVE-2015-8351—
Medium6.1Cross-Site Scripting
WordPress Calls to Action<2.5.1Update to 2.5.1
CVE-2015-8350—
Critical9.8Arbitrary File Upload
Iptanus File Upload<3.4.1Update to 3.4.1
CVE-2015-9341—
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager<0.4.7Update to 0.4.7
CVE-2017-14530—
Critical9.8SQL Injection
Visitors Online by BestWebSoft≤0.3Update to 0.4
CVE-2015-9325—
High8.8SQL Injection
wp-championship<5.9Update to 5.9
CVE-2015-5308—
High8.8Authenticated SQL Injection
Dynamic Widgets≤1.5.10Update to 1.5.11
CVE-2015-10100—
Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection<3.1.5Update to 3.1.5
CVE-2015-9357—
Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress<1.0.5Update to 1.0.5
CVE-2015-9405—
Medium6.3Authenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction<2.0.19Update to 2.0.19
CVE-2015-7682—
Medium4.9Path Traversal
Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!≤7.5Update to 7.5.1
CVE-2015-7683—
Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction<2.0.19Update to 2.0.19
CVE-2015-7377—
High8.8Arbitrary File Upload
Ajax Load More – Infinite Scroll, Load More, & Lazy Load≤2.8.1.1Update to 2.8.1.2
CVE-2015-10140—
Critical9.8SQL Injection
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms<1.1.1Update to 1.1.1
CVE-2015-9335—
High7.5Arbitrary File Download
History Collection≤1.1.1No patch available
CVE-2015-9470—
  • Medium6.1
    Reflected Cross-Site Scripting

    Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    <1.3.29Update to 1.3.29

    CVE-2015-8354

  • High8.8
    Authenticated Blind SQL Injection

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.64Update to 1.5.64

    CVE-2015-9395

  • Critical9.8
    SQL Injection

    Google Doc Embedder

    <2.5.17Update to 2.5.17

    CVE-2014-9173

  • Medium6.1
    Reflected Cross-Site Scripting

    Auto Thickbox Plus

    ≤1.9No patch available

    CVE-2015-9396

  • Medium6.1
    Reflected Cross-Site Scripting

    Websimon Tables

    ≤1.3.4No patch available

    CVE-2015-9401

  • High7.2
    Authenticated SQL Injection

    WP-Stats-Dashboard

    ≤2.9.4No patch available

    CVE-2015-9399

  • Critical9.8
    SQL Injection

    Double Opt-In for Download

    <2.0.9Update to 2.0.9

    CVE-2015-7517

  • High7.2
    Authenticated (Admin+) SQL Injection

    Watu Quiz

    ≤2.6.7Update to 2.6.8

    CVE-2015-10111

  • High8.8
    Arbitrary File Upload

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.59Update to 1.5.59

    CVE-2015-9402

  • Critical9.8
    SQL Injection

    WP Fastest Cache – WordPress Cache Plugin

    <0.8.4.9Update to 0.8.4.9

    CVE-2015-9316

  • Medium6.1
    Reflected Cross-Site Scripting

    User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

    <2.2.5Update to 2.2.5

    CVE-2015-9328

  • High8.8
    Cross-Site Request Forgery

    Tag Miner (Automatic Tag Extraction)

    <1.1.5Update to 1.1.5

    CVE-2016-10978

  • Medium6.1
    Cross-Site Scripting

    Tag Miner (Automatic Tag Extraction)

    <1.1.5Update to 1.1.5

    CVE-2016-10979

  • Medium6.1
    Reflected Cross-Site Scripting

    neuvoo-jobroll

    ≤2.0No patch available

    CVE-2015-9403

  • Medium6.1
    Reflected Cross-Site Scripting

    neuvoo-jobroll

    ≤2.0No patch available

    CVE-2015-9404

  • Critical9.0
    Remote File Inclusion

    Gwolle Guestbook

    <1.5.4Update to 1.5.4

    CVE-2015-8351

  • Medium6.1
    Cross-Site Scripting

    WordPress Calls to Action

    <2.5.1Update to 2.5.1

    CVE-2015-8350

  • Critical9.8
    Arbitrary File Upload

    Iptanus File Upload

    <3.4.1Update to 3.4.1

    CVE-2015-9341

  • High8.8
    Cross-Site Request Forgery to Stored Cross-Site Scripting

    Crony Cronjob Manager

    <0.4.7Update to 0.4.7

    CVE-2017-14530

  • Critical9.8
    SQL Injection

    Visitors Online by BestWebSoft

    ≤0.3Update to 0.4

    CVE-2015-9325

  • High8.8
    SQL Injection

    wp-championship

    <5.9Update to 5.9

    CVE-2015-5308

  • High8.8
    Authenticated SQL Injection

    Dynamic Widgets

    ≤1.5.10Update to 1.5.11

    CVE-2015-10100

  • Medium6.1
    Cross-Site Scripting

    Akismet Anti-spam: Spam Protection

    <3.1.5Update to 3.1.5

    CVE-2015-9357

  • Medium6.1
    Cross-Site Scripting

    Connect Matomo – Analytics Dashboard for WordPress

    <1.0.5Update to 1.0.5

    CVE-2015-9405

  • Medium6.3
    Authenticated SQL Injection

    Pie Register – User Registration, Profiles & Content Restriction

    <2.0.19Update to 2.0.19

    CVE-2015-7682

  • Medium4.9
    Path Traversal

    Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!

    ≤7.5Update to 7.5.1

    CVE-2015-7683

  • Medium6.1
    Reflected Cross-Site Scripting

    Pie Register – User Registration, Profiles & Content Restriction

    <2.0.19Update to 2.0.19

    CVE-2015-7377

  • High8.8
    Arbitrary File Upload

    Ajax Load More – Infinite Scroll, Load More, & Lazy Load

    ≤2.8.1.1Update to 2.8.1.2

    CVE-2015-10140

  • Critical9.8
    SQL Injection

    Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms

    <1.1.1Update to 1.1.1

    CVE-2015-9335

  • High7.5
    Arbitrary File Download

    History Collection

    ≤1.1.1No patch available

    CVE-2015-9470

Search VulnCrest Radar

Jump to

Are you sure?