The WordPress plugin 10Web Social Photo Feed up to and including version 1.5.6 contains a PHP Object Injection flaw (CWE-502) that results from unsafe deserialization of untrusted data. An attacker with a Contributor-level account can exploit it over the network to manipulate how the site processes data, with a possible impact on confidentiality, integrity and availability. No fixed version or vendor workaround is known yet, and no active exploitation or public exploit is recorded.
10Web · Social Photo Feed
The 10Web Booster WordPress plugin (speed optimization, caching and image optimization) up to and including version 2.34.10 does not validate file types or extensions in the compressCustom function. A REST nonce that the plugin writes to a world-readable file under wp-content/uploads/ when a bulk optimization batch pauses can be reused by unauthenticated visitors, so an attacker can upload files that may be executable. This can lead to remote code execution on the web server.
10Web · Booster (WordPress plugin)
The WordPress plugin Slider by 10Web (slider-wd) up to and including version 1.2.62 deserializes untrusted data, which allows PHP object injection. An authenticated attacker with low privileges, such as a Contributor account, can manipulate how the site processes data and run harmful actions on the server. The CVSS score is 8.8 and the impact on confidentiality, integrity and availability is rated high.
10Web · Slider by 10Web
The Photo Gallery by 10Web WordPress plugin up to and including version 1.8.46 contains a PHP object injection flaw (CWE-502). An attacker with a Contributor-level account can supply manipulated serialized data, which may let them change how the site processes data and run harmful actions on the server. Exploitation requires an authenticated Contributor account, so the flaw is not exploitable without login. Sites with multiple author accounts or open self-registration are most exposed.
10Web · Photo Gallery
The WordPress plugin 10Web Booster (Website speed optimization, Cache & Page Speed optimizer) in versions up to and including 2.33.6 contains a PHP Object Injection vulnerability (CWE-502). An attacker with a Contributor account can submit crafted serialized data that the plugin processes unsafely. Depending on the code available on the site, this can lead to manipulation of data or execution of harmful actions on the server. The risk is highest on sites with open user registration or many contributor accounts.
10Web · Booster
