CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1337)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2015-9373 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3314 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9294 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9368 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9515 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9527 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9370 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9529 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9532 | — | |
| Medium5.3 | Reflected Cross Site Scripting | CVE-2015-10098 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9363 | — | |
| Medium5.4 | Cross-Site Scripting via Ephox in Plupload | CVE-2015-3439 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9376 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3313 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9524 | — | |
| Medium6.1 | Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7 | CVE-2015-9512 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9365 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9519 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9375 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9511 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9362 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10110 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2014-4518 | — | |
| High7.5 | Missing Access Controls | CVE-2015-9337 | — | |
| Medium5.3 | SQL Injection | CVE-2015-3325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9493 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-10137 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9333 | — |
- Medium6.1Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Critical9.8SQL Injection
Tune Library
<1.5.5Update to 1.5.5
- Medium6.1Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.5Update to 3.9.5
- Medium6.1Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – htaccess Editor
1.0.0 – 1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
- Medium6.1Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
- Medium6.1Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
- Medium5.3Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
- Medium6.1Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
- Medium5.4Cross-Site Scripting via Ephox in Plupload
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
- Medium6.1Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
- Critical9.8SQL Injection
Community Events
≤1.3Update to 1.4
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
- Medium6.1Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
- Medium6.1Cross-Site Scripting
exchange-addon-table-rate-shipping
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
- Medium6.1Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
- Medium5.3Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available
- High7.5Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
- Medium5.3SQL Injection
WP Symposium
<15.4Update to 15.4
- Medium6.1Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
- Critical9.8Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
- Critical9.8SQL Injection
cformsII
<14.6.10Update to 14.6.10