WordPress Custom field finder Plugin <= 0.3 is vulnerable to PHP Object Injection

Software Custom field finder Type Plugin Vulnerable versions = 0.3 Fixed in 0.4 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-33641 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 73f25d40c87c Credits CatFather Required privilege Author...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to PHP Object Injection

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-33553 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 49ab51cfb6ce Credits Rafie Muhammad Patchstack Required privilege...

CVE-2024-32817 WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.2...

CVE-2024-32817 WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.26.2...

Master Slider < 3.9.7 - Unauthenticated PHP Object Injection

Description The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.9.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is...

WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Trình Vũ / Sonicrrrr from VNPT-VCI Patchstack Alliance in WordPress Plugin Import and export users and customers versions = 1.26.2...

WordPress Import and export users and customers Plugin <= 1.26.2 is vulnerable to PHP Object Injection

Software Import and export users and customers Type Plugin Vulnerable versions = 1.26.2 Fixed in 1.26.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32817 Patch priority Low CVSS severity Low 4.4 Developer Codection PSID db71a86e52da Credits Trình Vũ Sonicrrrr from...

CVE-2024-32600 WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5...

Import Users from CSV < 1.3 - Authenticated (Admin+) PHP Object Injection

Description The Import Users from CSV plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object...

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer vulnerability

Authenticated Subscriber+ PHP Object Injection via auxintemplatecontrolimporter vulnerability discovered by Rhynorater - Critical Thinking Podcast, Michael Brackett in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.5...

Shortcodes and extra features for Phlox theme <= 2.15.2 - Subscriber+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxintemplatecontrolimporter' function. This makes it possible for authenticated attackers able to upload a separate PHAR payload as an image file to inje...

WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.16.2 is vulnerable to PHP Object Injection

Software Shortcodes and extra features for Phlox theme Type Plugin Vulnerable versions = 2.16.2 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-7064 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID b9a2bdf53bc0 Credits Rhynorater -...

WordPress WooBuddy Plugin <= 3.4.20 is vulnerable to PHP Object Injection

Software WooBuddy Type Plugin Vulnerable versions = 3.4.20 Fixed in 3.4.21 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32603 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a5c09e662bc0 Credits LVT-tholv2k Required privilege Subscriber...

WordPress Master Slider Plugin <= 3.9.5 is vulnerable to PHP Object Injection

Software Master Slider Type Plugin Vulnerable versions = 3.9.5 Fixed in 3.9.7 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32600 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID d3cbc5a0e9db Credits Rafie Muhammad Patchstack Required privile...

CVE-2024-32431 WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection

Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2...

CVE-2024-32431 WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection

Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2...

WordPress WPvivid Backup and Migration Plugin <= 0.9.99 is vulnerable to PHP Object Injection

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.99 Fixed in 0.9.100 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-3054 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 2efae3e5e650 Credits Maksim Kosenko Required...

WordPress Import Users from CSV Plugin <= 1.2 is vulnerable to PHP Object Injection

Software Import Users from CSV Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32431 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID e3f19c84ef38 Credits Trình Vũ Sonicrrrr from VNPT-VCI Require...

WordPress Carousel, Slider, Gallery by WP Carousel plugin <= 2.6.3 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by hoanpk in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions = 2.6.3...

Product Designer < 1.0.33 - Unauthenticated PHP Object Injection

Description The Product Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.32 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the...