VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1346)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1346)
SeverityVulnerabilityCVEInstallsPublished
Critical9.8SQL Injection
gallery-objects≤0.4No patch available
CVE-2014-5201—
Medium6.3Multiple Cross-Site Request Forgery
Disqus Comment System<2.79Update to 2.79
CVE-2014-5346—
High7.1Cross-Site Scripting
Login Widget With Shortcode<3.2.1Update to 3.2.1
CVE-2014-6312—
Medium6.11.6.1 - Cross-Site Scripting
Cakifo1.0 – 1.6.1Update to 1.6.2
CVE-2014-3903—
Medium5.3Improper Input Validation
WP-Ban<1.64Update to 1.64
CVE-2014-6230—
High7.3Cross-Site Scripting via range Parameter
WooCommerce<2.2.3Update to 2.2.3
CVE-2014-6313—
Medium5.3Full Path Disclosure
WP Support Plus Responsive Ticket System<4.2Update to 4.2
CVE-2014-10388—
Critical9.8SQL Injection
WP Support Plus Responsive Ticket System<4.2Update to 4.2
CVE-2014-10387—
High7.5Arbitrary File Download
Antioch≤1.3No patch available
CVE-2014-10397—
Critical9.8Arbitrary File Download
Epic Church by Organized Themes≤3.6No patch available
CVE-2014-10396—
High8.8Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery≤1.0.7Update to 1.0.8
CVE-2014-7153—
High8.8Arbitrary File Upload
Slideshow Gallery LITE<1.4.7Update to 1.4.7
CVE-2014-5460—
Medium5.3Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
CVE-2014-0173—
Medium6.1Cross-Site Scripting
Memphis Documents Library<3.0Update to 3.0
CVE-2014-10385—
High7.2Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)<2.8.3Update to 2.8.3
CVE-2014-6059—
Medium6.1Reflected Cross-Site Scripting
Iptanus File Upload≤2.4.3Update to 2.4.4
CVE-2014-125110—
High7.5Directory Traversal
WP Source Control<3.1.1Update to 3.1.1
CVE-2014-5368—
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend≤1.2.5Update to 1.2.6
CVE-2014-5196—
Medium5.4Cross-Site Request Forgery
Disqus Comment System<2.76Update to 2.76
CVE-2014-5347—
Medium6.1Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps<2.3.8Update to 2.3.8
CVE-2014-5344—
High8.3SQL Injection
GB Gallery Slideshow<1.6Update to 1.6
CVE-2014-8375—
Medium6.3Cross-Site Request Forgery
Iptanus File Upload<2.4.2Update to 2.4.2
CVE-2014-5199—
Medium6.5Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft≤1.0.0Update to 1.0.1
CVE-2014-125100—
High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.81Update to 3.82
CVE-2014-125095—
High7.1Reflected Cross-Site Scripting
SI Captcha Anti-spam<2.7.6Update to 2.7.6
CVE-2014-5190—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter≤1.3.2Update to 1.3.7
CVE-2014-125103—
Medium6.1Open Redirect
Feed Statistics<4.0Update to 4.0
CVE-2018-17074—
Medium6.5Denial of Service via XML #2
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5266—
Medium6.5Brute Force of Cross-Site Request Forgery Tokens
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5205—
High8.8Cross-Site Request Forgery to Authentication Takeover
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-9033—

Search VulnCrest Radar

Jump to

Are you sure?