CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1351)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4594 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4548 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4567 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4598 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4568 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4591 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4579 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4582 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4528 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4605 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4557 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4564 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4546 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4544 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| Critical9.8 | SQL Injection | CVE-2014-4938 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4540 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4593 | — |
- Medium6.1Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
- Medium6.1Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
- High7.1Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
- Medium6.1Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
- Medium6.1Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- Medium6.1Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
- Medium6.1Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
- Medium6.1Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
- Medium6.1Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- Critical9.8SQL Injection
WP Rss Poster
≤1.0.0No patch available
- High7.1Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
- Medium6.1Cross-Site Scripting
wppm
≤1.6.4.bNo patch available