WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection

Software KD Coming Soon Type Plugin Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-46615 Patch priority High CVSS severity High 5.4 Developer Claim ownership PSID 340885e1964a Credits Mika Required privilege Unauthenticated...

CVE-2023-4386

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

CVE-2023-4386

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

Deserialization of untrusted data

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

CVE-2023-4386 Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

CVE-2023-4386

The CVE-2023-4386 entry concerns the WordPress Essential Blocks plugin (WPDeveloper) with PHP Object Injection due to insecure deserialization in get_posts. Affected versions are up to and including 4.2.0. The vulnerability allows unauthenticated attackers to inject a PHP object via untrusted inp...

CVE-2023-4386 Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

CVE-2023-4402

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugi...

CVE-2023-4402

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugi...

Deserialization of untrusted data

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugi...

CVE-2023-4402

The WordPress Essential Blocks plugin (versions up to and including 4.2.0) is affected by a PHP Object Injection via deserialization of untrusted input in the get_products/get_posts path. The vulnerability allows unauthenticated attackers to inject a PHP Object; exploitation may enable deletion o...

CVE-2023-4402 Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugi...

CVE-2023-4402 Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugi...

PT-2023-29014 · WordPress · Essential Blocks

Name of the Vulnerable Software and Affected Versions: The Essential Blocks plugin for WordPress versions up to, and including, 4.2.0 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the get posts function. If a POP chain is...

PT-2023-29071 · WordPress · Essential Blocks

Name of the Vulnerable Software and Affected Versions: The Essential Blocks plugin for WordPress versions up to, and including, 4.2.0 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the get products function. This could...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-46147 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID ae279380be0f Credits Rafie Muhammad Patchstack Required privileg...

WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

Software e2pdf Type Plugin Vulnerable versions = 1.20.18 Fixed in 1.20.19 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-46154 Patch priority Low CVSS severity Low 6.6 Developer E2Pdf.com PSID f89d3fc37d51 Credits trein Required privilege Administrator Published 17...

WordPress NextGEN Gallery Plugin < 3.39 is vulnerable to PHP Object Injection

Software NextGEN Gallery Type Plugin Vulnerable versions 3.39 Fixed in 3.39 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-3154 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 2db7a0c70c48 Credits Linwz from DEVCORE Required privilege...

WordPress Weaver Xtreme Theme Support Plugin < 6.3.1 is vulnerable to PHP Object Injection

Software Weaver Xtreme Theme Support Type Plugin Vulnerable versions 6.3.1 Fixed in 6.3.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-4971 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 68d407ee3a34 Credits Do Xuan Trung Required privilege...

WordPress Enable Media Replace Plugin < 4.1.3 PHP Object Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:shortpixel:enablemediareplace"; if description...