VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1357)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress PHP Object Injection vulnerabilities (page 1357)
SeverityVulnerabilityCVEInstallsPublished
Critical9.8SQL Injection
Testimonial<2.3Update to 2.3
CVE-2013-5673—
High8.8Cross-Site Request Forgery
Testimonial<2.3Update to 2.3
CVE-2013-5672—
Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.34Update to 3.35
CVE-2013-7481—
Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP≤4.25.3Update to 4.27
CVE-2013-5714—
Medium6.1Cross-Site Scripting
BackWPup – WordPress Backup & Restore Plugin<3.0.13Update to 3.0.13
CVE-2013-4626—
Medium6.1Reflected Cross-Site Scripting
A Forms≤1.4.2Update to 1.4.3
CVE-2013-10020—
Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.5Update to 5.5
CVE-2013-7478—
Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.51Update to 3.52
CVE-2013-7475—
Medium6.1Cross-Site Scripting
HMS Testimonials<2.0.11Update to 2.0.11
CVE-2013-4241—
High7.1Cross-Site Request Forgery
HMS Testimonials<2.0.11Update to 2.0.11
CVE-2013-4240—
High7.2Cross-Site Scripting via sort Parameter
Download Monitor<3.3.6.2Update to 3.3.6.2
CVE-2013-5098—
Medium6.1Cross-Site Scripting via p Parameter
Download Monitor<3.3.6.2Update to 3.3.6.2
CVE-2013-3262—
Medium6.1Reflected Cross-Site Scripting
Category Grid View Gallery≤2.3.1Update to 2.3.2
CVE-2013-4117—
Medium6.1Cross-Site Scripting
BuddyPress Extended Friendship Request<1.0.2Update to 1.0.2
CVE-2013-4944—
Medium6.1DOM Cross-Site Scripting
Xorbin Digital Flash Clock≤1.0No patch available
CVE-2013-4693—
High8.8Cross-Site Request Forgery
qTranslate≤2.5.39No patch available
CVE-2013-3251—
Medium5.4 Server Side Request Forgery
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2199—
Medium5.4XXE Injection
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2202—
Medium6.4Cross-Site Scripting via Multiple Vectors
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2201—
Medium4.6Content-Spoofing Attacks
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2204—
Medium4.3Sensitive Information Disclosure
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2203—
Medium5.3Denial of Service via wp-postpass cookie
WordPress<3.5.2Update to 3.5.2
CVE-2013-2173—
Medium6.3 Missing Authorization Checks
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2200—
Medium6.4Cross-Site Scripting
WordPress≤3.5.1Update to 3.5.2
CVE-2013-2205—
Critical9.8Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤1.9.12Update to 1.9.13
CVE-2013-3684—
Medium5.4Missing Authorization Checks & Cross-Site Request Forgery
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder<1.8.8Update to 1.8.8
CVE-2013-3250—
Medium5.3Full Path Dislcosure
WordPress Exit Box Lite1.06 – 1.06Update to 1.10
CVE-2013-10030—
Medium5.3Information Exposure
WordPress Exit Strategy≤1.55Update to 1.59
CVE-2013-10024—
Medium4.3Cross-Site Request Forgery
WordPress Exit Strategy≤1.55Update to 1.59
CVE-2013-10025—
Medium4.3Cross-Site Request Forgery
WordPress Exit Box Lite≤1.06Update to 1.10
CVE-2013-10029—

Search VulnCrest Radar

Jump to

Are you sure?