Optiontree Project

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Optiontree Project records in CISA KEV

No Optiontree Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Optiontree · all components

TI-2019-11425 CVE-2019-15321 · GHSA-hwg2-m583-m62g

MEDIUM 46

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2019-08-22 No fix listed CWE-502

TI-2019-11424 CVE-2019-15320 · GHSA-522x-fpg2-whf4

MEDIUM 46

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2019-08-22 No fix listed CWE-502

TI-2019-11423 CVE-2019-15319 · GHSA-2cv6-5p72-5vx5

MEDIUM 46

The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2019-08-22 No fix listed CWE-502

TI-2016-08933 CVE-2016-10895 · GHSA-5g2m-vp9w-hprq

LOW 29

The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00913 Published 2019-08-20 No fix listed CWE-79

TI-2015-07697 CVE-2015-9320 · GHSA-244f-hg9f-wp78

LOW 29

The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00924 Published 2019-08-20 No fix listed CWE-79