CVE-2024-7561 The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection

The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the wpedenpostmeta post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject...

PT-2024-38420 · WordPress · The News Flash

Name of the Vulnerable Software and Affected Versions: The News Flash theme for WordPress versions up to, and including, 1.1.0 Description: The issue allows authenticated attackers with Editor-level access and above to inject a PHP Object via deserialization of untrusted input from the newsflash...

WordPress News Flash theme <= 1.1.0 - Authenticated (Editor+) PHP Object Injection vulnerability

Authenticated Editor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme News Flash versions = 1.1.0...

WordPress MultiPurpose theme <= 1.2.0 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme Multipurpose versions = 1.2.0...

WordPress The Next theme <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme The Next LVL versions = 1.1.0...

WordPress News Flash Theme <= 1.1.0 is vulnerable to PHP Object Injection

Software News Flash Type Theme Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7560 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 645105e26eb0 Credits Francesco Carlucci Required privilege Editor...

WordPress Participants Database Plugin <= 2.5.9.2 is vulnerable to PHP Object Injection

Software Participants Database Type Plugin Vulnerable versions = 2.5.9.2 Fixed in 2.5.9.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-43141 Patch priority Medium CVSS severity Medium 9.8 Developer Claim ownership PSID 859a2e5c56af Credits LVT-tholv2k Required...

WordPress Multipurpose Theme <= 1.2.0 is vulnerable to PHP Object Injection

Software Multipurpose Type Theme Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7486 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 5a908ef6f2c7 Credits Francesco Carlucci Required privilege...

WordPress The Next LVL Theme <= 1.1.0 is vulnerable to PHP Object Injection

Software The Next LVL Type Theme Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7561 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID b79740b6d53a Credits Francesco Carlucci Required privilege...

CVE-2024-39636 WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1...

CVE-2024-39636 WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1...

CVE-2024-39630 WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13...

WordPress Essential Addons for Elementor Plugin < 5.9.14 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdeveloper:essentialaddonsforelementor"; ifdescription...

WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Trình Vũ Sonicrrrr from VNPT-VCI in WordPress Plugin Better Find and Replace versions = 1.6.1...

WordPress Flipbox Builder plugin <= 1.5 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Flipbox Builder versions = 1.5...

WordPress Better Find and Replace Plugin <= 1.6.1 is vulnerable to PHP Object Injection

Software Better Find and Replace Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-39636 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID c0c0efbac1bd Credits Trình Vũ Sonicrrrr from VNPT-VCI...

WordPress Flipbox Builder Plugin <= 1.5 is vulnerable to PHP Object Injection

Software Flipbox Builder Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-6152 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 06c48daece2a Credits Francesco Carlucci Required privilege...

CVE-2024-6152

The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input in the flipboxbuilderFlipboxShortCode function. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-6152

CVE-2024-6152 describes a PHP object injection in the WordPress plugin Flipbox Builder (versions ≤ 1.5) via deserialization in the flipbox_builder_Flipbox_ShortCode function. Authenticated attackers with Contributor-level access or higher can inject a PHP object. No POP chain is known in the core...

CVE-2024-6152 Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection

The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input in the flipboxbuilderFlipboxShortCode function. This makes it possible for authenticated attackers, with Contributor-level access and...