CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1331)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Directory Traversal | CVE-2015-5471 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9462 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5528 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9461 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-9463 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9313 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2015-3299 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9460 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9312 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2015-9479 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9465 | — | |
| Medium6.1 | Open Redirect | CVE-2015-5461 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9466 | — | |
| High7.5 | Directory Traversal to Arbitrary File Access | CVE-2015-9464 | — | |
| High7.5 | Directory Traversal | CVE-2015-5468 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9467 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9468 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9340 | — | |
| High7.5 | Directory Traversal | CVE-2015-5469 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5682 | — | |
| Critical9.1 | Path Traversal | CVE-2015-5609 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5681 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-9314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5057 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9342 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9343 | — | |
| Critical9.8 | SQL Injection | CVE-2015-5599 | — | |
| High8.8 | Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update | CVE-2015-9474 | — | |
| High8.8 | Arbitrary Options Update | CVE-2015-9475 | — | |
| High7.5 | Directory Traversal | CVE-2015-4704 | — |
- Medium5.3Directory Traversal
Swim Team
≤1.44.1077Update to 1.45.1085
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- Medium6.1Cross-Site Scripting
Floating Social Bar
<1.1.7Update to 1.1.7
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- High7.5Arbitrary File Download
S3Bubble Cloud Video with Adverts and Analytics
<4.8Update to 4.8
- Critical9.8SQL Injection
NewStatPress
<1.0.6Update to 1.0.6
- Medium6.1Unauthenticated Cross-Site Scripting
Floating Social Bar
≤1.1.6Update to 1.1.7
- High8.8Authenticated SQL Injection
Pinpoint Booking System – Legacy version
<2.1Update to 2.1
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.0.6Update to 1.0.6
- Critical9.8Unauthenticated Arbitrary File Upload
acf-frontend-display
≤2.0.6No patch available
- High8.8Authenticated SQL Injection
YASR – Yet Another Star Rating Plugin for WordPress
<0.9.1Update to 0.9.1
- Medium6.1Open Redirect
StageShow
<5.0.9Update to 5.0.9
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- High7.5Directory Traversal to Arbitrary File Access
S3 Bubble Amazon S3 HTML5 Video with Adverts
≤0.7Update to 0.8
- High7.5Directory Traversal
WP eCommerce Shop Styling
<2.6Update to 2.6
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- High7.2Stored Cross-Site Scripting
NewStatPress
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Broken Link Checker
<1.10.9Update to 1.10.9
- Medium6.1Cross-Site Scripting
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- High8.8Cross-Site Request Forgery
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
Powerplay Gallery
≤3.3No patch available
- High8.8Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update
Simpolio - Fullscreen Portfolio & Blog HTML Theme
≤1.3.2No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available