MidnightBSD

Advisories for optiontree_project

CVE-2015-9320 MEDIUM

The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
nvd@nist.gov 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2.8 2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor Product Version
optiontree_project optiontree *
CVE-2016-10895 MEDIUM

The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor Product Version
optiontree_project optiontree *
CVE-2019-15319 HIGH

The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-502,

Products Affected

Vendor Product Version
optiontree_project optiontree *
CVE-2019-15320 HIGH

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-502,

Products Affected

Vendor Product Version
optiontree_project optiontree *
CVE-2019-15321 HIGH

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-502,

Products Affected

Vendor Product Version
optiontree_project optiontree *