CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1354)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.5 | Stored Cross-Site Scripting | CVE-2014-3123 | — | |
| High7.5 | 3.9.001 - Missing Authorization | CVE-2014-3849 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4537 | — | |
| Medium5.3 | Missing Authorization | CVE-2014-3844 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3841 | — | |
| High7.5 | Missing Authorization and Sensitive Data Exposure | CVE-2014-3848 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4584 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4530 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4525 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4531 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4529 | — | |
| High7.2 | Remote Code Execution | CVE-2014-2558 | — | |
| High7.2 | 3.9.001 - Remote Code Execution | CVE-2014-8949 | — | |
| High8.8 | 3.9.001 - Cross-Site Request Forgery | CVE-2014-8948 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-125093 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-100001 | — | |
| Medium5.5 | Stored Cross-Site Scripting | CVE-2014-2995 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2014-100018 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2333 | — | |
| Critical9.6 | Multiple Cross-Site Request Forgery | CVE-2014-2579 | — | |
| Medium6.5 | Authentication Cookie Forgery | CVE-2014-0166 | — | |
| Medium4.3 | Contributor Users Can Publish Posts | CVE-2014-0165 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2014-2559 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10902 | — | |
| Medium5.4 | Cross-Site Request Forgery | CVE-2014-2340 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-100009 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100008 | — | |
| Critical9.8 | Local File Inclusion | CVE-2014-2674 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2838 | — | |
| High7.2 | Blind SQL Injection | CVE-2014-2839 | — |
- Medium5.5Stored Cross-Site Scripting
NextCellent Gallery – NextGEN Legacy
<1.9.18Update to 1.9.18
- High7.53.9.001 - Missing Authorization
iMember360is
3.8.012 – <3.9.001Update to 3.9.001
- Medium6.1Reflected Cross-Site Scripting
Keyword Strategy Internal Links
≤2.0No patch available
- Medium5.3Missing Authorization
TinyMCE Color Picker
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
≤2.0.19Update to 2.0.20
- High7.5Missing Authorization and Sensitive Data Exposure
iMember360is
<3.9.001Update to 3.9.001
- Medium6.1Cross-Site Scripting
wp-easybooking
≤1.0.3No patch available
- Medium6.1Cross-Site Scripting
flog
≤0.1No patch available
- Medium6.1Cross-Site Scripting
WP eBay Product Feeds
<1.1Update to 1.1
- High7.1Cross-Site Scripting
Game tabs
≤0.4.0No patch available
- Medium6.1Cross-Site Scripting
flash-photo-gallery
≤0.7No patch available
- High7.2Remote Code Execution
File Gallery
<1.7.9.2Update to 1.7.9.2
- High7.23.9.001 - Remote Code Execution
iMember360is
3.8.012 – 3.9.001Update to 3.9.002
- High8.83.9.001 - Cross-Site Request Forgery
iMember360is
3.8.012 – <3.9.001Update to 3.9.001
- Medium5.3Full Path Disclosure
Ad Blocking Detector
≤1.2.1Update to 1.2.2
- High8.8Cross-Site Request Forgery
SEO Plugin LiveOptim
≤1.1.3Update to 1.1.4
- Medium5.5Stored Cross-Site Scripting
Twitget
≤3.3.2Update to 3.3.3
- High7.1Reflected Cross-Site Scripting
Unconfirmed
<1.2.5Update to 1.2.5
- Medium6.4Stored Cross-Site Scripting
Lazyest Gallery
<1.1.21Update to 1.1.21
- Critical9.6Multiple Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<3.1.1Update to 3.1.1
- Medium6.5Authentication Cookie Forgery
WordPress
≤3.8.1Update to 3.7.2 or 3.8.2
- Medium4.3Contributor Users Can Publish Posts
WordPress
≤3.8.1Update to 3.7.2 or 3.8.2
- Medium6.3Cross-Site Request Forgery
Twitget
<3.3.3Update to 3.3.3
- High8.8Cross-Site Request Forgery
WP Customer Reviews
<3.0.9Update to 3.0.9
- Medium5.4Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<3.1.1Update to 3.1.1
- Medium5.3Full Path Disclosure
JS Multi Hotel
≤2.2.1No patch available
- Medium6.1Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- Critical9.8Local File Inclusion
Ajax Pagination (twitter Style)
≤1.1No patch available
- High8.8Cross-Site Request Forgery
GD Star Rating
≤1.9.22No patch available
- High7.2Blind SQL Injection
GD Star Rating
≤1.9.22No patch available