CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1334)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1334)
Severity	Vulnerability	CVE	Installs	Published
High7.5	Sensitive Information Disclosure Accio \| Responsive Onepage Parallax Site Template<1.1.1Update to 1.1.1	CVE-2015-9485	—	May 15, 2015
High7.5	Sensitive Information Disclosure Invento \| Architecture Building Agency Template≤2015-05-15No patch available	CVE-2015-9483	—	May 15, 2015
High7.5	Sensitive Information Disclosure Almera Responsive Portfolio Site Template<1.1.8Update to 1.1.8	CVE-2015-9488	—	May 15, 2015
High7.5	Sensitive Information Disclosure Accio \| Responsive Onepage Parallax Agency WordPress Theme≤1.1.0Update to 1.1.1	CVE-2015-9484	—	May 15, 2015
High7.5	Sensitive Information Disclosure Goodnex Responsive HTML5/CSS3 Site Template<1.1.3Update to 1.1.3	CVE-2015-9489	—	May 15, 2015
High7.5	Sensitive Information Disclosure Car Dealer Automotive WordPress Theme – Responsive<1.1.9Update to 1.1.9	CVE-2015-9482	—	May 15, 2015
High7.5	Information Disclosure SmartIT Premium Responsiveall versionsNo patch available	CVE-2015-9492	—	May 15, 2015
Medium6.1	Cross-Site Scripting Awesome Support – WordPress HelpDesk & Support Plugin<3.1.7Update to 3.1.7	CVE-2015-9317	—	May 15, 2015
High7.5	Sensitive Information Disclosure Diplomat \| Political Campaign, Party, Blog Responsive WordPress Theme≤1.0.1Update to 1.0.2	CVE-2015-9481	—	May 15, 2015
High7.5	Sensitive Information Disclosure GamesTheme≤1.0.3No patch available	CVE-2015-9490	—	May 15, 2015
Medium6.1	Reflected Cross-Site Scripting FeedWordPress<2015.0514Update to 2015.0514	CVE-2015-9358	—	May 14, 2015
Medium6.1	Cross-Site Scripting Post Kinds<1.3.1.1Update to 1.3.1.1	CVE-2015-9494	—	May 13, 2015
Medium6.1	DOM-based Cross-Site Scripting Syndication Links<1.3Update to 1.3	CVE-2015-9495	—	May 13, 2015
Medium6.1	Cross-Site Scripting Modern≤1.4.1Update to 1.4.2	CVE-2015-9503	—	May 12, 2015
Medium6.1	Reflected Cross-Site Scripting Google AdSense Click-Fraud Monitoring Plugin≤1.8.6No patch available	CVE-2015-3998	—	May 11, 2015
Medium4.3	Cross-Site Request Forgery Inline Google Spreadsheet Viewer≤0.9.6Update to 0.9.6.1	CVE-2015-10108	—	May 11, 2015
Medium6.1	Cross-Site Scripting Backup, Restore and Migrate your sites with XCloner≤3.1.2Update to 3.1.3	CVE-2015-4337	—	May 10, 2015
High8.8	Remote Command Execution Backup, Restore and Migrate your sites with XCloner≤3.1.2Update to 3.1.3	CVE-2015-4336	—	May 10, 2015
Critical9.8	Remote Code Execution Backup, Restore and Migrate your sites with XCloner<3.1.3Update to 3.1.3	CVE-2015-4338	—	May 10, 2015
High8.2	Arbitrary File Upload Iptanus File Upload<2.7.1Update to 2.7.1	CVE-2015-9339	—	May 9, 2015
High7.2	Cross-Site Scripting Roomcloud<1.3Update to 1.3	CVE-2015-3904	—	May 9, 2015
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Ad Buttons<2.3.2Update to 2.3.2	CVE-2017-18553	—	May 8, 2015
High7.2	Cross-Site Scripting via Comments WordPress≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2	CVE-2015-8834	—	May 7, 2015
Medium6.1	Reflected Cross-Site Scripting Simplr Registration Form Plus+≤2.3.4Update to 2.3.5	CVE-2015-10107	—	May 6, 2015
Medium4.8	Cross-Site Scripting Affiliate Ads for cbAds.com≤1.20Update to 1.35	CVE-2015-20106	—	May 6, 2015
Medium6.1	Cross-Site Scripting Artificial Intelligence<1.2.4Update to 1.2.4	CVE-2015-9501	—	May 6, 2015
Medium6.1	Cross-Site Scripting Auberge<1.4.5Update to 1.4.5	CVE-2015-9502	—	May 6, 2015
Medium6.1	Cross-Site Scripting eShop<6.3.12Update to 6.3.12	CVE-2015-3421	—	May 6, 2015
High8.8	SQL Injection Freshmail for WordPress<1.6Update to 1.6	CVE-2015-9496	—	May 6, 2015
High8.8	Cross-Site Request Forgery to Stored Cross-Site Scripting Affiliate Ads for cbAds.com<1.31Update to 1.31	CVE-2015-20105	—	May 6, 2015

High7.5
Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Site Template
<1.1.1Update to 1.1.1
CVE-2015-9485May 15, 2015
High7.5
Sensitive Information Disclosure
Invento | Architecture Building Agency Template
≤2015-05-15No patch available
CVE-2015-9483May 15, 2015
High7.5
Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8
CVE-2015-9488May 15, 2015
High7.5
Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Agency WordPress Theme
≤1.1.0Update to 1.1.1
CVE-2015-9484May 15, 2015
High7.5
Sensitive Information Disclosure
Goodnex Responsive HTML5/CSS3 Site Template
<1.1.3Update to 1.1.3
CVE-2015-9489May 15, 2015
High7.5
Sensitive Information Disclosure
Car Dealer Automotive WordPress Theme – Responsive
<1.1.9Update to 1.1.9
CVE-2015-9482May 15, 2015
High7.5
Information Disclosure
SmartIT Premium Responsive
all versionsNo patch available
CVE-2015-9492May 15, 2015
Medium6.1
Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
CVE-2015-9317May 15, 2015
High7.5
Sensitive Information Disclosure
Diplomat | Political Campaign, Party, Blog Responsive WordPress Theme
≤1.0.1Update to 1.0.2
CVE-2015-9481May 15, 2015
High7.5
Sensitive Information Disclosure
GamesTheme
≤1.0.3No patch available
CVE-2015-9490May 15, 2015
Medium6.1
Reflected Cross-Site Scripting
FeedWordPress
<2015.0514Update to 2015.0514
CVE-2015-9358May 14, 2015
Medium6.1
Cross-Site Scripting
Post Kinds
<1.3.1.1Update to 1.3.1.1
CVE-2015-9494May 13, 2015
Medium6.1
DOM-based Cross-Site Scripting
Syndication Links
<1.3Update to 1.3
CVE-2015-9495May 13, 2015
Medium6.1
Cross-Site Scripting
Modern
≤1.4.1Update to 1.4.2
CVE-2015-9503May 12, 2015
Medium6.1
Reflected Cross-Site Scripting
Google AdSense Click-Fraud Monitoring Plugin
≤1.8.6No patch available
CVE-2015-3998May 11, 2015
Medium4.3
Cross-Site Request Forgery
Inline Google Spreadsheet Viewer
≤0.9.6Update to 0.9.6.1
CVE-2015-10108May 11, 2015
Medium6.1
Cross-Site Scripting
Backup, Restore and Migrate your sites with XCloner
≤3.1.2Update to 3.1.3
CVE-2015-4337May 10, 2015
High8.8
Remote Command Execution
Backup, Restore and Migrate your sites with XCloner
≤3.1.2Update to 3.1.3
CVE-2015-4336May 10, 2015
Critical9.8
Remote Code Execution
Backup, Restore and Migrate your sites with XCloner
<3.1.3Update to 3.1.3
CVE-2015-4338May 10, 2015
High8.2
Arbitrary File Upload
Iptanus File Upload
<2.7.1Update to 2.7.1
CVE-2015-9339May 9, 2015
High7.2
Cross-Site Scripting
Roomcloud
<1.3Update to 1.3
CVE-2015-3904May 9, 2015
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Ad Buttons
<2.3.2Update to 2.3.2
CVE-2017-18553May 8, 2015
High7.2
Cross-Site Scripting via Comments
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2
CVE-2015-8834May 7, 2015
Medium6.1
Reflected Cross-Site Scripting
Simplr Registration Form Plus+
≤2.3.4Update to 2.3.5
CVE-2015-10107May 6, 2015
Medium4.8
Cross-Site Scripting
Affiliate Ads for cbAds.com
≤1.20Update to 1.35
CVE-2015-20106May 6, 2015
Medium6.1
Cross-Site Scripting
Artificial Intelligence
<1.2.4Update to 1.2.4
CVE-2015-9501May 6, 2015
Medium6.1
Cross-Site Scripting
Auberge
<1.4.5Update to 1.4.5
CVE-2015-9502May 6, 2015
Medium6.1
Cross-Site Scripting
eShop
<6.3.12Update to 6.3.12
CVE-2015-3421May 6, 2015
High8.8
SQL Injection
Freshmail for WordPress
<1.6Update to 1.6
CVE-2015-9496May 6, 2015
High8.8
Cross-Site Request Forgery to Stored Cross-Site Scripting
Affiliate Ads for cbAds.com
<1.31Update to 1.31
CVE-2015-20105May 6, 2015