CWE-502Vulnerability type

WordPress PHP Object Injection vulnerabilities (page 1360)

unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.

WordPress PHP Object Injection vulnerabilities (page 1360)
Severity	Vulnerability	CVE	Installs	Published
High7.5	Directory Traversal Download Shortcode≤0.2.3Update to 1.0	CVE-2014-5465	—	Jan 3, 2013
High8.8	Cross-Site Request Forgery Mingle Forum≤1.0.34Update to 1.0.35	CVE-2013-0736	—	Jan 2, 2013
Medium5.4	Missing Session Cookie Expiration WordPress<4.0Update to 4.0	CVE-2012-5868	—	Dec 27, 2012
High8.8	Cross-Site Request Forgery Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5178	—	Dec 14, 2012
Medium6.1	Cross-Site Scripting Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5177	—	Dec 14, 2012
Medium6.1	Reflected Cross-Site Scripting BuddyStream≤3.6.2Update to 3.6.3	CVE-2012-10007	—	Dec 4, 2012
Medium6.1	Cross-Site Scripting Video Lead Form<0.6Update to 0.6	CVE-2012-6312	—	Nov 26, 2012
Medium5.3	Sensitive Information Disclosure Simple Gmail Login<1.1.4Update to 1.1.4	CVE-2012-6313	—	Nov 24, 2012
Medium6.1	Cross-Site Scripting Advanced Text Widget≤2.0.1Update to 2.0.2	CVE-2011-4618	—	Nov 21, 2012
Medium6.1	Cross-Site Scripting Uk Cookie≤1.1No patch available	CVE-2012-5856	—	Nov 13, 2012
Medium6.1	Cross-Site Scripting Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤1.9.6Update to 1.9.7	CVE-2012-3414	—	Nov 9, 2012
Critical9.8	Unauthenticated SQL Injection Cardoza AJAX Search<1.3Update to 1.3	CVE-2012-5853	—	Nov 6, 2012
High7.3	SQL Injection All Video Gallery Plugin for WordPress<1.2Update to 1.2	CVE-2012-6653	—	Nov 2, 2012
Medium6.1	Cross Site Scripting via post_title parameter Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤2.1.1Update to 2.2	CVE-2012-6692	—	Oct 31, 2012
High7.1	Reflected Cross-Site Scripting White Label CMS<1.5.1Update to 1.5.1	CVE-2012-5387	—	Oct 21, 2012
High7.1	Cross-Site Scripting White Label CMS<1.5.1Update to 1.5.1	CVE-2012-5388	—	Oct 21, 2012
Medium6.1	Cross-Site Scripting MF Gig Calendar≤0.9.4.1Update to 0.9.5	CVE-2012-4242	—	Sep 23, 2012
Medium6.1	Cross-Site Scripting WHOIS≤1.4.2.4No patch available	CVE-2011-5193	—	Sep 23, 2012
High7.5	Information Disclosure via Arbitrary File Downloads simple-download-button-shortcode1.0 – 1.0Update to 1.1	CVE-2012-10016	—	Sep 17, 2012
High8.8	Cross-Site Request Forgery DVS Custom Notification≤1.0.1No patch available	CVE-2012-4921	—	Sep 14, 2012
Low3.8	Missing Authorization Checks WordPress≤3.4.1Update to 3.4.2	CVE-2012-4422	—	Sep 6, 2012
Medium6.3	Missing Authorization Checks on create_post WordPress<3.4.2Update to 3.4.2	CVE-2012-4421	—	Sep 6, 2012
Medium6.4	Cross-Site Scripting WordPress≤3.4.1Update to 3.4.2	CVE-2012-3383	—	Sep 6, 2012
Medium6.1	Reflected Cross-Site Scripting Download Monitor≤3.3.5.8Update to 3.3.5.9	CVE-2012-4768	—	Sep 6, 2012
Medium6.1	Multiple Cross-Site Scripting quick-post-widget≤1.9.1No patch available	CVE-2012-4226	—	Aug 10, 2012
Medium6.1	Cross-Site Scripting ThreeWP Email Reflector<1.16Update to 1.16	CVE-2012-2572	—	Aug 8, 2012
High7.2	Cross-Site Scripting mini-mail-dashboard-widget<1.43Update to 1.43	CVE-2012-2583	—	Aug 8, 2012
High7.2	Cross-Site Scripting Postie≤1.4.9Update to 1.4.10	CVE-2012-2580	—	Aug 8, 2012
Medium6.1	Cross-Site Scripting WP SimpleMail≤1.0.6No patch available	CVE-2012-2579	—	Aug 8, 2012
High7.5	Directory Traversal Vitamin<1.1.0Update to 1.1.0	CVE-2012-6651	—	Aug 7, 2012

High7.5
Directory Traversal
Download Shortcode
≤0.2.3Update to 1.0
CVE-2014-5465Jan 3, 2013
High8.8
Cross-Site Request Forgery
Mingle Forum
≤1.0.34Update to 1.0.35
CVE-2013-0736Jan 2, 2013
Medium5.4
Missing Session Cookie Expiration
WordPress
<4.0Update to 4.0
CVE-2012-5868Dec 27, 2012
High8.8
Cross-Site Request Forgery
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5178Dec 14, 2012
Medium6.1
Cross-Site Scripting
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5177Dec 14, 2012
Medium6.1
Reflected Cross-Site Scripting
BuddyStream
≤3.6.2Update to 3.6.3
CVE-2012-10007Dec 4, 2012
Medium6.1
Cross-Site Scripting
Video Lead Form
<0.6Update to 0.6
CVE-2012-6312Nov 26, 2012
Medium5.3
Sensitive Information Disclosure
Simple Gmail Login
<1.1.4Update to 1.1.4
CVE-2012-6313Nov 24, 2012
Medium6.1
Cross-Site Scripting
Advanced Text Widget
≤2.0.1Update to 2.0.2
CVE-2011-4618Nov 21, 2012
Medium6.1
Cross-Site Scripting
Uk Cookie
≤1.1No patch available
CVE-2012-5856Nov 13, 2012
Medium6.1
Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.6Update to 1.9.7
CVE-2012-3414Nov 9, 2012
Critical9.8
Unauthenticated SQL Injection
Cardoza AJAX Search
<1.3Update to 1.3
CVE-2012-5853Nov 6, 2012
High7.3
SQL Injection
All Video Gallery Plugin for WordPress
<1.2Update to 1.2
CVE-2012-6653Nov 2, 2012
Medium6.1
Cross Site Scripting via post_title parameter
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤2.1.1Update to 2.2
CVE-2012-6692Oct 31, 2012
High7.1
Reflected Cross-Site Scripting
White Label CMS
<1.5.1Update to 1.5.1
CVE-2012-5387Oct 21, 2012
High7.1
Cross-Site Scripting
White Label CMS
<1.5.1Update to 1.5.1
CVE-2012-5388Oct 21, 2012
Medium6.1
Cross-Site Scripting
MF Gig Calendar
≤0.9.4.1Update to 0.9.5
CVE-2012-4242Sep 23, 2012
Medium6.1
Cross-Site Scripting
WHOIS
≤1.4.2.4No patch available
CVE-2011-5193Sep 23, 2012
High7.5
Information Disclosure via Arbitrary File Downloads
simple-download-button-shortcode
1.0 – 1.0Update to 1.1
CVE-2012-10016Sep 17, 2012
High8.8
Cross-Site Request Forgery
DVS Custom Notification
≤1.0.1No patch available
CVE-2012-4921Sep 14, 2012
Low3.8
Missing Authorization Checks
WordPress
≤3.4.1Update to 3.4.2
CVE-2012-4422Sep 6, 2012
Medium6.3
Missing Authorization Checks on create_post
WordPress
<3.4.2Update to 3.4.2
CVE-2012-4421Sep 6, 2012
Medium6.4
Cross-Site Scripting
WordPress
≤3.4.1Update to 3.4.2
CVE-2012-3383Sep 6, 2012
Medium6.1
Reflected Cross-Site Scripting
Download Monitor
≤3.3.5.8Update to 3.3.5.9
CVE-2012-4768Sep 6, 2012
Medium6.1
Multiple Cross-Site Scripting
quick-post-widget
≤1.9.1No patch available
CVE-2012-4226Aug 10, 2012
Medium6.1
Cross-Site Scripting
ThreeWP Email Reflector
<1.16Update to 1.16
CVE-2012-2572Aug 8, 2012
High7.2
Cross-Site Scripting
mini-mail-dashboard-widget
<1.43Update to 1.43
CVE-2012-2583Aug 8, 2012
High7.2
Cross-Site Scripting
Postie
≤1.4.9Update to 1.4.10
CVE-2012-2580Aug 8, 2012
Medium6.1
Cross-Site Scripting
WP SimpleMail
≤1.0.6No patch available
CVE-2012-2579Aug 8, 2012
High7.5
Directory Traversal
Vitamin
<1.1.0Update to 1.1.0
CVE-2012-6651Aug 7, 2012