CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1353)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1353)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting dsSearchAgent: WordPress Edition<1.0-beta10No patch available	CVE-2014-4522	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Local Weather≤1.0No patch available	CVE-2014-4561	—	May 25, 2014
Medium6.1	CBI Referral Manager <= 1.2.1 Cross-Site Scripting CBI Referral Manager≤1.2.1No patch available	CVE-2014-4517	—	May 25, 2014
Medium6.1	Cross-Site Scripting WordPress Social Login≤2.1.5Update to 2.1.6	CVE-2014-4576	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting ooorl≤1.0.0No patch available	CVE-2014-4542	—	May 25, 2014
High7.1	Cross-Site Scripting GEO Redirector≤1.0.1No patch available	CVE-2014-4533	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Movies≤0.6No patch available	CVE-2014-4539	—	May 25, 2014
Medium6.1	Cross-Site Scripting proquoter≤1.0No patch available	CVE-2014-4545	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Contact≤1.0No patch available	CVE-2014-4583	—	May 25, 2014
Medium6.1	Cross-Site Scripting Style It≤1.0No patch available	CVE-2014-4555	—	May 25, 2014
Medium6.1	Stored Cross-Site Scripting WP Ultimate Email Marketer≤1.1.0No patch available	CVE-2014-4600	—	May 25, 2014
Medium6.1	Cross-Site Scripting verwei.se – WordPress – Twitter≤1.0.2No patch available	CVE-2014-4566	—	May 25, 2014
High7.1	Cross-Site Scripting Toolpage≤1.6.1No patch available	CVE-2014-4560	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting HTML5 Video Player with Playlist≤2.4.0No patch available	CVE-2014-4534	—	May 25, 2014
Medium6.1	Cross-Site Scripting Social Connect≤0.10.1Update to 0.10.2	CVE-2014-4551	—	May 25, 2014
Medium6.4	Cross-Site Scripting shortcode-ninja≤1.4No patch available	CVE-2014-4550	—	May 25, 2014
Medium6.1	Cross-Site Scripting GarageSale<1.2.3Update to 1.2.3	CVE-2014-4532	—	May 25, 2014
Medium6.1	Cross-Site Scripting Import Legacy Media≤0.1No patch available	CVE-2014-4535	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting WP-Planet≤0.1No patch available	CVE-2014-4592	—	May 25, 2014
Medium6.1	Multiple Cross-Site Scripting WP e-Commerce Swipe plugin≤3.1.0No patch available	CVE-2014-4559	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Business Directory≤1.0.2No patch available	CVE-2014-4599	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-RSS-Spreadshirt-3DCube-Gallery≤1.3No patch available	CVE-2014-4553	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Votecount For Balatarin≤0.1.1No patch available	CVE-2014-4572	—	May 25, 2014
Medium6.1	Cross-Site Scripting Conversion Ninjaall versionsNo patch available	CVE-2014-4017	—	May 22, 2014
High8.8	SQL Injection Pinpoint Booking System – Legacy version<1.3Update to 1.3	CVE-2014-3210	—	May 21, 2014
Medium6.1	3.9.001 - Cross-Site Scripting iMember360is3.8.012 – <3.9.002Update to 3.9.002	CVE-2014-3842	—	May 14, 2014
High8.8	Cross-Site Request Forgery Login rebuilder<1.2.0Update to 1.2.0	CVE-2014-3882	—	May 14, 2014
High8.8	Cross-Site Request Forgery Photo Gallery by 10Web – Mobile-Friendly Image Gallery<1.2.42Update to 1.2.42	CVE-2015-9380	—	May 7, 2014
Medium4.3	Cross-Site Request Forgery Search Everything<8.1.1Update to 8.1.1	CVE-2014-3843	—	May 6, 2014
Medium4.3	Cross-Site Request Forgery TinyMCE Color Picker<1.2Update to 1.2	CVE-2014-3845	—	May 1, 2014

Medium6.1
Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
CVE-2014-4522May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Local Weather
≤1.0No patch available
CVE-2014-4561May 25, 2014
Medium6.1
CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
CVE-2014-4517May 25, 2014
Medium6.1
Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
CVE-2014-4576May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
CVE-2014-4542May 25, 2014
High7.1
Cross-Site Scripting
GEO Redirector
≤1.0.1No patch available
CVE-2014-4533May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Movies
≤0.6No patch available
CVE-2014-4539May 25, 2014
Medium6.1
Cross-Site Scripting
proquoter
≤1.0No patch available
CVE-2014-4545May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Contact
≤1.0No patch available
CVE-2014-4583May 25, 2014
Medium6.1
Cross-Site Scripting
Style It
≤1.0No patch available
CVE-2014-4555May 25, 2014
Medium6.1
Stored Cross-Site Scripting
WP Ultimate Email Marketer
≤1.1.0No patch available
CVE-2014-4600May 25, 2014
Medium6.1
Cross-Site Scripting
verwei.se – WordPress – Twitter
≤1.0.2No patch available
CVE-2014-4566May 25, 2014
High7.1
Cross-Site Scripting
Toolpage
≤1.6.1No patch available
CVE-2014-4560May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
HTML5 Video Player with Playlist
≤2.4.0No patch available
CVE-2014-4534May 25, 2014
Medium6.1
Cross-Site Scripting
Social Connect
≤0.10.1Update to 0.10.2
CVE-2014-4551May 25, 2014
Medium6.4
Cross-Site Scripting
shortcode-ninja
≤1.4No patch available
CVE-2014-4550May 25, 2014
Medium6.1
Cross-Site Scripting
GarageSale
<1.2.3Update to 1.2.3
CVE-2014-4532May 25, 2014
Medium6.1
Cross-Site Scripting
Import Legacy Media
≤0.1No patch available
CVE-2014-4535May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
WP-Planet
≤0.1No patch available
CVE-2014-4592May 25, 2014
Medium6.1
Multiple Cross-Site Scripting
WP e-Commerce Swipe plugin
≤3.1.0No patch available
CVE-2014-4559May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Business Directory
≤1.0.2No patch available
CVE-2014-4599May 25, 2014
Medium6.1
Cross-Site Scripting
WP-RSS-Spreadshirt-3DCube-Gallery
≤1.3No patch available
CVE-2014-4553May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Votecount For Balatarin
≤0.1.1No patch available
CVE-2014-4572May 25, 2014
Medium6.1
Cross-Site Scripting
Conversion Ninja
all versionsNo patch available
CVE-2014-4017May 22, 2014
High8.8
SQL Injection
Pinpoint Booking System – Legacy version
<1.3Update to 1.3
CVE-2014-3210May 21, 2014
Medium6.1
3.9.001 - Cross-Site Scripting
iMember360is
3.8.012 – <3.9.002Update to 3.9.002
CVE-2014-3842May 14, 2014
High8.8
Cross-Site Request Forgery
Login rebuilder
<1.2.0Update to 1.2.0
CVE-2014-3882May 14, 2014
High8.8
Cross-Site Request Forgery
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.42Update to 1.2.42
CVE-2015-9380May 7, 2014
Medium4.3
Cross-Site Request Forgery
Search Everything
<8.1.1Update to 8.1.1
CVE-2014-3843May 6, 2014
Medium4.3
Cross-Site Request Forgery
TinyMCE Color Picker
<1.2Update to 1.2
CVE-2014-3845May 1, 2014