CWE-502Vulnerability type
WordPress PHP Object Injection vulnerabilities (page 1367)
unserialize() on user input. Exploitable when a POP chain exists in WordPress, a plugin or a theme.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting | CVE-2010-5294 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2010-4403 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2010-4402 | — | |
| Critical9.8 | SQL Injection | CVE-2010-4839 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4630 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2010-4637 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2010-4875 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-3977 | — | |
| Medium4.7 | Missing Authorization | CVE-2010-5297 | — | |
| Critical9.8 | SQL Injection | CVE-2010-2924 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-1186 | — | |
| Critical9.8 | Copperleaf Photolog <= 0.16- SQL injection | CVE-2010-0673 | — | |
| Medium4.3 | Authorization Bypass | CVE-2010-0682 | — | |
| Critical9.8 | SQL Injection | CVE-2009-4424 | — | |
| High8.8 | Arbitrary File Upload | CVE-2009-3890 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2009-3891 | — | |
| Medium6.1 | Cross-Site Scripting via tagcloud | CVE-2009-4168 | — | |
| Medium5.3 | Sensitive Information Exposure | CVE-2009-4170 | — | |
| High8.8 | Arbitrary File Upload | CVE-2009-4140 | — | |
| Medium6.5 | Denial of Service | CVE-2009-3622 | — | |
| Critical9.8 | Multiple SQL Injections | CVE-2009-3703 | — | |
| High7.1 | Cross-Site Scripting | CVE-2009-4169 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2009-2432 | — | |
| High7.5 | Forced Password Reset | CVE-2009-2762 | — | |
| High7.3 | Authorization Bypass | CVE-2009-2853 | — | |
| High7.3 | Missing Authorization | CVE-2009-2854 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2009-5158 | — | |
| High7.2 | Cross-Site Scripting | CVE-2009-2851 | — | |
| Medium6.4 | SQL Injection | CVE-2009-4748 | — | |
| Medium6.1 | Sensitive Information Disclosure | CVE-2009-2334 | — |
- Medium6.4Cross-Site Scripting
WordPress
<3.0.2Update to 3.0.2
- Medium5.3Sensitive Information Disclosure
Register Plus
≤3.5.11No patch available
- High7.2Stored Cross-Site Scripting
Register Plus
≤3.5.11No patch available
- Critical9.8SQL Injection
Event Registration
<6.00.03Update to 6.00.03
- Medium6.1Cross-Site Scripting
WP Survey And Quiz Tool
<1.3Update to 1.3
- Medium6.1Reflected Cross-Site Scripting
FeedList
≤2.61.03Update to 2.70.00
- Medium6.1Reflected Cross-Site Scripting
vodpod-video-gallery
≤3.1.7No patch available
- Medium6.1Cross-Site Scripting
cformsII
≤11.5Update to 11.6.1
- Medium4.7Missing Authorization
WordPress
<3.0.1Update to 3.0.1
- Critical9.8SQL Injection
myLinksDump
≤1.2No patch available
- Medium6.1Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<1.5.2Update to 1.5.2
- Critical9.8Copperleaf Photolog <= 0.16- SQL injection
Copperleaf Photolog
≤0.16No patch available
- Medium4.3Authorization Bypass
WordPress
<2.9.2Update to 2.9.2
- Critical9.8SQL Injection
Pyrmont V2
≤2.0.7No patch available
- High8.8Arbitrary File Upload
WordPress
≤2.8.5Update to 2.8.6
- Medium6.4Cross-Site Scripting
WordPress
≤2.8.5Update to 2.8.6
- Medium6.1Cross-Site Scripting via tagcloud
WP Cumulus
≤1.22Update to 1.23
- Medium5.3Sensitive Information Exposure
WP Cumulus
≤1.20Update to 1.23
- High8.8Arbitrary File Upload
Piwik PRO
0.2.35 – 0.4.3Update to 0.4.4
- Medium6.5Denial of Service
WordPress
≤2.8.4Update to 2.8.5
- Critical9.8Multiple SQL Injections
wp-forum
<2.4Update to 2.4
- High7.1Cross-Site Scripting
WP Cumulus
<1.22Update to 1.22
- Medium5.3Full Path Disclosure
WordPress
≤2.8Update to 2.8.1
- High7.5Forced Password Reset
WordPress
≤2.8.3Update to 2.8.4
- High7.3Authorization Bypass
WordPress
≤2.8.2Update to 2.8.3
- High7.3Missing Authorization
WordPress
≤2.8.2Update to 2.8.3
- Medium6.1Cross-Site Scripting
Analyticator
<5.2.1Update to 5.2.1
- High7.2Cross-Site Scripting
WordPress
≤2.8.1Update to 2.8.2
- Medium6.4SQL Injection
my-category-order
≤2.8.7Update to 3.0.1
- Medium6.1Sensitive Information Disclosure
WordPress
≤2.8Update to 2.8.1