VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1329)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1329)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Cross-Site Request Forgery to Cross-Site Scripting
bookmarkify≤1.1.3No patch available
CVE-2015-9441—
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Monetize≤1.03No patch available
CVE-2015-9440—
Medium6.5Cross-Site Scripting
Avenir-soft Direct Download≤1.0No patch available
CVE-2015-9442—
Medium6.1Reflected Cross-Site Scripting
Qtranslate Slug≤1.1.16Update to 1.1.17
CVE-2015-10092—
Critical9.6Cross-Site Request Forgery to Post Lockage
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5731—
Medium6.1< 0.7.23 - Stored Cross-Site Scripting
Job Manager<0.7.23Update to 0.7.23
CVE-2015-2321—
Medium5.3Timing Side-Channel Attack
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5730—
Medium6.1Cross-Site Scripting in Theme Preview
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5734—
High8.8SQL Injection
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-2213—
Medium5.5Cross-Site Scripting via Widget Title
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5732—
Medium5.4Stored Cross-Site Scripting via accessibility-helper Title
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5733—
Medium6.5Remote File Download
Simple Image Manipulator≤1.0No patch available
CVE-2015-1000010—
Medium6.1Reflected Cross-Site Scripting
YITH Maintenance Mode≤1.1.4Update to 1.2.0
CVE-2015-9429—
Medium5.5Authenticated (Admin+) Cross-Site Scripting
Content Grabber≤1.0No patch available
CVE-2015-9469—
Medium6.1Cross-Site Scripting
qTranslate≤2.5.39No patch available
CVE-2015-5535—
Medium6.1Cross-Site Scripting
The Holiday Calendar<1.11.3Update to 1.11.3
CVE-2015-9270—
Medium6.1Reflected Cross-Site Scripting
Flickr Justified Gallery<3.4.0Update to 3.4.0
CVE-2015-9327—
Medium6.1Reflected Cross-Site Scripting
Clean Login≤1.5Update to 1.5.1
CVE-2015-9336—
High8.8SQL Injection
Unite Gallery Lite<1.5Update to 1.5
CVE-2015-9446—
High7.2Cross-Site Request Forgery and SQL Injection
Unite Gallery Lite<1.5Update to 1.5
CVE-2015-9447—
High8.8Cross-Site Request Forgery & Authenticated SQL Injection
Unite Gallery Lite≤1.4.6Update to 1.5
CVE-2015-9445—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WordPress≤4.2.2Update to 3.7.9 or 3.8.9 or 3.9.7 or 4.0.6 or 4.1.6 or 4.2.3
CVE-2015-5622—
Medium6.5Authorization Bypass
WordPress≤4.2.2Update to 3.7.9 or 3.8.9 or 3.9.7 or 4.0.6 or 4.1.6 or 4.2.3
CVE-2015-5623—
High8.8Authenticated SQL Injection
SendPress Newsletters<1.2Update to 1.2
CVE-2015-9448—
High7.2Cross-Site Request Forgery
Count per Day<3.4.1Update to 3.4.1
CVE-2015-5533—
Medium6.1Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce<4.1.6.1Update to 4.1.6.1
CVE-2015-9273—
Medium6.1Multiple Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions<1.8.4.3Update to 1.8.4.3
CVE-2015-5532—
High7.2Authenticated Blind SQL Injection
Microblog Poster – Auto Publish on Social Media<1.6.2Update to 1.6.2
CVE-2015-9449—
Medium6.3Cross-Site Request Forgery
Portfolio Plugin<1.05Update to 1.05
CVE-2015-6523—
High7.5Sensitive Information Exposure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps<2.1.3Update to 2.1.3
CVE-2015-9269—

Search VulnCrest Radar

Jump to

Are you sure?