CVE-2024-5649

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...

CVE-2024-5724

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-5724

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-5649

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...

CVE-2024-5649

The CVE-2024-5649 entry concerns Universal Slider (fusion-slider) for WordPress, affected up to version 1.6.5. It describes PHP Object Injection via deserialization of untrusted input in the fsl_get_gallery_value function. The advisory states that authenticated attackers with Contributor-level ac...

CVE-2024-5649 Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...

CVE-2024-5649 Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...

CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-5724

CVE-2024-5724 affects the Photo Video Gallery Master plugin for WordPress (up to v1.5.3). It exposes PHP Object Injection via deserialization of the PVGM_all_photos_details parameter, exploitable by authenticated users with Contributor+ access. The advisory notes that there is no known POP chain ...

CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

WordPress plugin Universal Slider security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-37100 · WordPress · Photo Video Gallery Master

Name of the Vulnerable Software and Affected Versions: Photo Video Gallery Master plugin for WordPress versions up to, and including, 1.5.3 Description: The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input PVGM all photos...

WordPress Custom Field Suite Plugin <= 2.6.7 is vulnerable to PHP Object Injection

Software Custom Field Suite Type Plugin Vulnerable versions = 2.6.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-3562 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 4d41dee4d577 Credits Jack Taylor Required privilege...

WordPress Page Builder: Live Composer Plugin <= 1.5.42 is vulnerable to PHP Object Injection

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.42 Fixed in 1.5.43 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-35780 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 6cf6e28bf12c Credits LVT-tholv2k Required...

WordPress plugin Photo Video Gallery Master security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress Photo Video Gallery Master plugin <= 1.5.3 - Authenticated PHP Object Injection vulnerability

Authenticated PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Photo Video Gallery Master versions = 1.5.3...

WordPress Universal Slider plugin <= 1.6.5 - Authenticated PHP Object Injection vulnerability

Authenticated PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Universal Slider versions = 1.6.5...

WordPress Universal Slider Plugin <= 1.6.5 is vulnerable to PHP Object Injection

Software Universal Slider Type Plugin Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5649 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2d895bf03490 Credits Francesco Carlucci Required privilege...

WordPress Photo Video Gallery Master Plugin <= 1.5.3 is vulnerable to PHP Object Injection

Software Photo Video Gallery Master Type Plugin Vulnerable versions = 1.5.3 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5724 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 22871a87af76 Credits Francesco Carlucci Required...

PT-2024-4398 · WordPress · Seopress

Name of the Vulnerable Software and Affected Versions: SEOPress versions prior to 7.9 Description: The issue is related to insufficient protection of some REST API routes in the SEOPress WordPress plugin, which can be combined with an Object Injection vulnerability to allow unauthenticated...