Vulnerabilities

TI-2019-11425 CVE-2019-15321 · GHSA-hwg2-m583-m62g

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

MEDIUM 46

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2019-08-22 No fix listed CWE-502

TI-2019-11424 CVE-2019-15320 · GHSA-522x-fpg2-whf4

MEDIUM 46

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2019-08-22 No fix listed CWE-502

TI-2019-11423 CVE-2019-15319 · GHSA-2cv6-5p72-5vx5

MEDIUM 46

The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02147 Published 2019-08-22 No fix listed CWE-502

TI-2015-07697 CVE-2015-9320 · GHSA-244f-hg9f-wp78

LOW 29

The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00924 Published 2019-08-20 No fix listed CWE-79

TI-2016-08933 CVE-2016-10895 · GHSA-5g2m-vp9w-hprq

LOW 29

The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00913 Published 2019-08-20 No fix listed CWE-79