CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1348)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2013-6342 | — | |
| Critical9.8 | Remote Code Execution | CVE-2013-2011 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-5128 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1463 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20003 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5329 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100007 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2013-10026 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3256 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2706 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-4725 | — | |
| Critical9.8 | Local/Remote File Inclusion | CVE-2013-7483 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4854 | — | |
| Medium6.1 | Cross-Site scripting | CVE-2014-4588 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3870 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4581 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2699 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-5918 | — | |
| Critical9.8 | Unrestricted File Upload | CVE-2014-4972 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3261 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2704 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0895 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3476 | — | |
| High7.5 | Local File Inclusion | CVE-2014-4577 | — | |
| High8.8 | SQL Injection | CVE-2012-5327 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4856 | — | |
| Medium5.3 | Reflected Cross-Site Scripting | CVE-2014-4565 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-4954 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-2484 | — |
- Medium6.1Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
- Critical9.8Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
- Medium5.3Cross-Site Scripting
Adminimize
<1.7.22Update to 1.7.22
- Medium6.1Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
- Medium6.1Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
- Medium6.1Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
- High8.8Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
- High8.8Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
- Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
- Critical9.8Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
- Medium6.1Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
- Medium6.1Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
bib2html
≤0.9.3No patch available
- Medium6.1Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
- High8.8Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1Update to 3.1.1
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- High7.5Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
- Medium5.3Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44