CVE Vulnerability Catalog

The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.

The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.

The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

The WordPress theme FC United in versions up to 1.1.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.

The WordPress theme ShiftCV in versions up to 3.0.14 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.

PHP Object Injection vulnerability in the Windsor theme in versions up to and including 2.10. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Education Center theme in versions up to and including 3.6.12. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Drone Media theme in versions up to and including 2.2.0. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

The YITH WooCommerce Product Add-Ons plugin up to version 4.34.0 exposes sensitive system information to unauthorized parties. The flaw allows retrieval of embedded sensitive data.

The Forminator plugin in versions up to and including 1.57.3 allows an unauthenticated attacker to delete arbitrary content on a WordPress site. The flaw requires no login or special privileges.

The WooCommerce Multilingual & Multicurrency plugin in versions up to and including 5.5.8 contains a PHP Object Injection flaw exploitable by a shop manager user. This may lead to dangerous code execution or further privilege escalation.

Arbitrary file upload vulnerability allowing a Contributor user to upload arbitrary files in the Creator LMS plugin in versions up to and including 1.2.21. A low-privileged user can upload arbitrary files to the server. This may lead to malicious code execution.

PHP Object Injection vulnerability in the Asia Garden theme in versions up to and including 1.3.1. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the N7 | Golf Club Sports & Events theme in versions up to and including 2.21. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Invetex theme in versions up to and including 2.18. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Law Office theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 has a broken access control flaw exploitable by an unauthenticated attacker. This allows access to functions or data that should be protected.

The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 is vulnerable to SQL injection exploitable by a subscriber-level user. The flaw allows manipulation of database queries.