CVE-2024-1770 Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection

The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the getpostdata function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP...

CVE-2024-1770 Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection

The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the getpostdata function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP...

PT-2024-18367 · WordPress · The Lightbox Slider – Responsive Lightbox Gallery

Name of the Vulnerable Software and Affected Versions: The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress versions up to, and including, 1.9.9 Description: The issue is related to PHP Object Injection via deserialization of untrusted input through post meta data. This allows...

WordPress Meta Tag Manager Plugin <= 3.0.2 is vulnerable to PHP Object Injection

Software Meta Tag Manager Type Plugin Vulnerable versions = 3.0.2 Fixed in 3.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1770 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID e36fbb9c63ac Credits Francesco Carlucci Required privilege...

Button < 1.1.28 - Contributor+ PHP Object Injection in button_shortcode

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the buttonshortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable...

Lightbox slider – Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection

Description The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via deserialization of untrusted input through post meta data. This makes it possible for authenticated attackers, with...

WordPress Social Pug Plugin <= 1.33.1 is vulnerable to PHP Object Injection

Software Social Pug Type Plugin Vulnerable versions = 1.33.1 Fixed in 1.33.2 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-2501 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 888eaee51d8b Credits Webbernaut Required privilege Contributo...

PT-2024-18380 · WordPress · The Button

Name of the Vulnerable Software and Affected Versions: The Button plugin for WordPress versions up to, and including, 1.1.28 Description: The issue is related to PHP Object Injection via deserialization of untrusted input in the button shortcode function. This allows authenticated attackers with...

CVE-2024-24842 WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 11.30.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2...

CVE-2024-24842 WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 11.30.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2...

Hubbub Lite – Fast, Reliable Social Network Sharing Buttons < 1.33.2 - PHP Object Injection

Description The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.33.1 via deserialization of untrusted input via the 'dpspmaybeunserialize' function. This makes it possible for authenticated...

Meta Tag Manager < 3.1 - Subscriber+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the getpostdata function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a PO...

CVE-2023-27459 WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1...

CVE-2023-27459 WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1...

WordPress ARMember Plugin <= 4.0.26 is vulnerable to PHP Object Injection

Software ARMember Type Plugin Vulnerable versions = 4.0.26 Fixed in 4.0.27 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-30223 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 8d16e0b0481c Credits LVT-tholv2k Required privilege Unauthenticated...

WordPress Sunshine Photo Cart Plugin <= 3.1.1 is vulnerable to PHP Object Injection

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A1: Broken Access Control Classification PHP Object Injection CVE CVE-2024-30221 Patch priority Medium CVSS severity Medium 5.4 Developer WP Sunshine PSID 7b2cd8d53b2f Credits CatFather Required...

WordPress Hercules Core Plugin <= 6.4 is vulnerable to PHP Object Injection

Software Hercules Core Type Plugin Vulnerable versions = 6.4 Fixed in 6.5 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-30228 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID f62f114ea206 Credits Dave Jong Patchstack Required privilege...

WordPress WP Migrate Plugin <= 2.6.10 is vulnerable to PHP Object Injection

Software WP Migrate Type Plugin Vulnerable versions = 2.6.10 Fixed in 2.6.11 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-30225 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6b6e8d810b6a Credits Dave Jong Patchstack Required privilege...

WordPress Geo Controller Plugin <= 8.6.4 is vulnerable to PHP Object Injection

Software Geo Controller Type Plugin Vulnerable versions = 8.6.4 Fixed in 8.6.5 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-30227 Patch priority High CVSS severity High 9 Developer Claim ownership PSID d77f0684feba Credits LVT-tholv2k Required privilege...

WordPress ARMember Plugin <= 4.0.26 is vulnerable to PHP Object Injection

Software ARMember Type Plugin Vulnerable versions = 4.0.26 Fixed in 4.0.27 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-30222 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 7cde346aedaf Credits LVT-tholv2k Required privilege Contributo...