CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1328)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1328)
Severity	Vulnerability	CVE	Installs	Published
Medium4.7	Cross-Site Scripting Analyticator<6.4.9.6Update to 6.4.9.6	CVE-2015-6238	—	Aug 24, 2015
High7.2	SQL Injection GigPress<2.3.11Update to 2.3.11	CVE-2015-9353	—	Aug 24, 2015
Medium6.1	Reflected Cross-Site Scripting Manual Image Crop<1.11Update to 1.11	CVE-2015-9426	—	Aug 24, 2015
Medium6.1	Reflected Cross-Site Scripting GigPress≤2.3.10Update to 2.3.11	CVE-2015-9354	—	Aug 24, 2015
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Googmonify≤0.5.1No patch available	CVE-2015-9427	—	Aug 23, 2015
Critical9.8	Blind SQL Injection DukaPress≤2.5.9Update to 2.5.9.1	CVE-2015-1000011	—	Aug 22, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9307	—	Aug 21, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9308	—	Aug 21, 2015
Medium6.1	Reflected Cross-Site Scripting qTranslate X<3.4.4Update to 3.4.4	CVE-2015-9431	—	Aug 21, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9309	—	Aug 21, 2015
High7.2	Stored Cross-Site Scripting Crazy Bone<0.6.0Update to 0.6.0	CVE-2015-9430	—	Aug 21, 2015
Medium5.4	Cross-Site Scripting Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages<1.1Update to 1.1	CVE-2015-9428	—	Aug 21, 2015
Medium6.1	Reflected Cross-Site Scripting Alpine Photo Tile for Instagram<1.2.7.6Update to 1.2.7.6	CVE-2015-9432	—	Aug 20, 2015
Medium6.1	Cross-Site Scripting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤1.3.17Update to 1.3.18	CVE-2015-9304	—	Aug 20, 2015
Medium6.1	Cross-Site Scripting MDC Private Message≤1.0.1No patch available	CVE-2015-6805	—	Aug 20, 2015
Critical9.8	SQL Injection 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring<2.0.3Update to 2.0.3	CVE-2015-9323	—	Aug 20, 2015
Medium6.5	Cross-Site Scripting WP Social Bookmarking Light<1.7.10Update to 1.7.10	CVE-2015-9433	—	Aug 19, 2015
Medium6.1	Cross-Site Scripting WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export<3.8.1Update to 3.8.1	CVE-2015-9306	—	Aug 18, 2015
Critical9.1	Open Proxy google-adsense-and-hotel-booking≤1.05No patch available	CVE-2015-1000009	—	Aug 15, 2015
Medium6.1	Reflected Cross-Site Scripting WP Latest Posts≤3.7.4Update to 3.7.5	CVE-2016-10913	—	Aug 15, 2015
Medium6.1	Cross-Site Scripting All-In-One Security (AIOS) – Security and Firewall<3.9.8Update to 3.9.8	CVE-2015-9293	—	Aug 15, 2015
Critical9.8	Pseudorandom Number Generation WP OAuth Server (OAuth Authentication)<3.1.5Update to 3.1.5	CVE-2015-9435	—	Aug 12, 2015
Medium4.8	Authenticated Cross-Site Scripting WordPress Share Buttons Plugin – AddThis<5.0.13Update to 5.0.13	CVE-2015-9439	—	Aug 11, 2015
Medium6.1	Refletced Cross-Site Scripting Dynamic Widgets<1.5.11Update to 1.5.11	CVE-2015-9437	—	Aug 11, 2015
Medium5.4	Cross-Site Scripting Dynamic Widgets<1.5.11Update to 1.5.11	CVE-2015-9436	—	Aug 11, 2015
Medium5.4	Authenticated Cross-Site Scripting Display Widgets≤2.03Update to 2.04	CVE-2015-9438	—	Aug 11, 2015
Critical9.8	Code Injection Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.6Update to 5.6	CVE-2015-9298	—	Aug 10, 2015
Medium6.4	Stored Cross-Site Scripting iframe≤4.0Update to 4.1	CVE-2015-6738	—	Aug 10, 2015
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.6Update to 5.6	CVE-2015-9297	—	Aug 10, 2015
Critical9.8	Unauthenticated SQL Injection WP Symposium<15.8Update to 15.8	CVE-2015-6522	—	Aug 9, 2015

Medium4.7
Cross-Site Scripting
Analyticator
<6.4.9.6Update to 6.4.9.6
CVE-2015-6238Aug 24, 2015
High7.2
SQL Injection
GigPress
<2.3.11Update to 2.3.11
CVE-2015-9353Aug 24, 2015
Medium6.1
Reflected Cross-Site Scripting
Manual Image Crop
<1.11Update to 1.11
CVE-2015-9426Aug 24, 2015
Medium6.1
Reflected Cross-Site Scripting
GigPress
≤2.3.10Update to 2.3.11
CVE-2015-9354Aug 24, 2015
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Googmonify
≤0.5.1No patch available
CVE-2015-9427Aug 23, 2015
Critical9.8
Blind SQL Injection
DukaPress
≤2.5.9Update to 2.5.9.1
CVE-2015-1000011Aug 22, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9307Aug 21, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9308Aug 21, 2015
Medium6.1
Reflected Cross-Site Scripting
qTranslate X
<3.4.4Update to 3.4.4
CVE-2015-9431Aug 21, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9309Aug 21, 2015
High7.2
Stored Cross-Site Scripting
Crazy Bone
<0.6.0Update to 0.6.0
CVE-2015-9430Aug 21, 2015
Medium5.4
Cross-Site Scripting
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
<1.1Update to 1.1
CVE-2015-9428Aug 21, 2015
Medium6.1
Reflected Cross-Site Scripting
Alpine Photo Tile for Instagram
<1.2.7.6Update to 1.2.7.6
CVE-2015-9432Aug 20, 2015
Medium6.1
Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.17Update to 1.3.18
CVE-2015-9304Aug 20, 2015
Medium6.1
Cross-Site Scripting
MDC Private Message
≤1.0.1No patch available
CVE-2015-6805Aug 20, 2015
Critical9.8
SQL Injection
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<2.0.3Update to 2.0.3
CVE-2015-9323Aug 20, 2015
Medium6.5
Cross-Site Scripting
WP Social Bookmarking Light
<1.7.10Update to 1.7.10
CVE-2015-9433Aug 19, 2015
Medium6.1
Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<3.8.1Update to 3.8.1
CVE-2015-9306Aug 18, 2015
Critical9.1
Open Proxy
google-adsense-and-hotel-booking
≤1.05No patch available
CVE-2015-1000009Aug 15, 2015
Medium6.1
Reflected Cross-Site Scripting
WP Latest Posts
≤3.7.4Update to 3.7.5
CVE-2016-10913Aug 15, 2015
Medium6.1
Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.8Update to 3.9.8
CVE-2015-9293Aug 15, 2015
Critical9.8
Pseudorandom Number Generation
WP OAuth Server (OAuth Authentication)
<3.1.5Update to 3.1.5
CVE-2015-9435Aug 12, 2015
Medium4.8
Authenticated Cross-Site Scripting
WordPress Share Buttons Plugin – AddThis
<5.0.13Update to 5.0.13
CVE-2015-9439Aug 11, 2015
Medium6.1
Refletced Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
CVE-2015-9437Aug 11, 2015
Medium5.4
Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
CVE-2015-9436Aug 11, 2015
Medium5.4
Authenticated Cross-Site Scripting
Display Widgets
≤2.03Update to 2.04
CVE-2015-9438Aug 11, 2015
Critical9.8
Code Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.6Update to 5.6
CVE-2015-9298Aug 10, 2015
Medium6.4
Stored Cross-Site Scripting
iframe
≤4.0Update to 4.1
CVE-2015-6738Aug 10, 2015
Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.6Update to 5.6
CVE-2015-9297Aug 10, 2015
Critical9.8
Unauthenticated SQL Injection
WP Symposium
<15.8Update to 15.8
CVE-2015-6522Aug 9, 2015