Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by wp_easy_post_types_project
CVE-2024-10079 (GCVE-0-2024-10079)
Vulnerability from nvd – Published: 2024-10-18 07:35 – Updated: 2026-04-08 17:24
VLAI
EPSS
VEX
Title
WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection
Summary
The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-18 13:55 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| chertz | WP Easy Post Types |
Affected:
0 , ≤ 1.4.4
(semver)
|
|
| wp_easy_post_types_project | wp_easy_post_types |
Affected:
0 , ≤ 1.4.4
(semver)
cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:*"
],
"defaultStatus": "unaffected",
"product": "wp_easy_post_types",
"vendor": "wp_easy_post_types_project",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T13:55:41.988153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T13:58:16.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Easy Post Types",
"vendor": "chertz",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the \u0027text\u0027 parameter in the \u0027ajax_import_content\u0027 function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:24:50.018Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d038f1a2-4755-417f-965d-508b57c05738?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L1318"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10079",
"datePublished": "2024-10-18T07:35:26.337Z",
"dateReserved": "2024-10-17T11:54:53.380Z",
"dateUpdated": "2026-04-08T17:24:50.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10078 (GCVE-0-2024-10078)
Vulnerability from nvd – Published: 2024-10-18 07:35 – Updated: 2026-04-08 17:25
VLAI
EPSS
VEX
Title
WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
Summary
The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-18 14:38 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
25 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| chertz | WP Easy Post Types |
Affected:
0 , ≤ 1.4.4
(semver)
|
|
| wp_easy_post_types_project | wp_easy_post_types |
Affected:
0 , ≤ 1.4.4
(semver)
cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:*"
],
"defaultStatus": "unaffected",
"product": "wp_easy_post_types",
"vendor": "wp_easy_post_types_project",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T14:38:25.438604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T14:39:32.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Easy Post Types",
"vendor": "chertz",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:25:07.056Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d12c4b1c-23d0-430f-a6ea-0a3ab487ed10?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L111"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L114"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L116"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L118"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L120"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L121"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L122"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L123"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L124"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L126"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L128"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L129"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L130"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L134"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10078",
"datePublished": "2024-10-18T07:35:26.905Z",
"dateReserved": "2024-10-17T11:54:40.466Z",
"dateUpdated": "2026-04-08T17:25:07.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2014-4524 (GCVE-0-2014-4524)
Vulnerability from nvd – Published: 2014-07-02 18:00 – Updated: 2024-08-06 11:20
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://wordpress.org/plugins/easy-post-types/changelog | x_refsource_CONFIRM |
| http://codevigilant.com/disclosure/wp-plugin-easy… | x_refsource_MISC |
| https://plugins.trac.wordpress.org/changeset?sfp_… | x_refsource_MISC |
Date Public
2014-05-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:20:25.980Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://wordpress.org/plugins/easy-post-types/changelog"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-02T17:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://wordpress.org/plugins/easy-post-types/changelog"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4524",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://wordpress.org/plugins/easy-post-types/changelog",
"refsource": "CONFIRM",
"url": "http://wordpress.org/plugins/easy-post-types/changelog"
},
{
"name": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss",
"refsource": "MISC",
"url": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss"
},
{
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail=",
"refsource": "MISC",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4524",
"datePublished": "2014-07-02T18:00:00.000Z",
"dateReserved": "2014-06-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T11:20:25.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10078 (GCVE-0-2024-10078)
Vulnerability from cvelistv5 – Published: 2024-10-18 07:35 – Updated: 2026-04-08 17:25
VLAI
EPSS
VEX
Title
WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
Summary
The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-18 14:38 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
25 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| chertz | WP Easy Post Types |
Affected:
0 , ≤ 1.4.4
(semver)
|
|
| wp_easy_post_types_project | wp_easy_post_types |
Affected:
0 , ≤ 1.4.4
(semver)
cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:*"
],
"defaultStatus": "unaffected",
"product": "wp_easy_post_types",
"vendor": "wp_easy_post_types_project",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T14:38:25.438604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T14:39:32.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Easy Post Types",
"vendor": "chertz",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:25:07.056Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d12c4b1c-23d0-430f-a6ea-0a3ab487ed10?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L111"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L114"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L116"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L117"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L118"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L120"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L121"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L122"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L123"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L124"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L126"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L128"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L129"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L130"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L131"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L134"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10078",
"datePublished": "2024-10-18T07:35:26.905Z",
"dateReserved": "2024-10-17T11:54:40.466Z",
"dateUpdated": "2026-04-08T17:25:07.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10079 (GCVE-0-2024-10079)
Vulnerability from cvelistv5 – Published: 2024-10-18 07:35 – Updated: 2026-04-08 17:24
VLAI
EPSS
VEX
Title
WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection
Summary
The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-18 13:55 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| chertz | WP Easy Post Types |
Affected:
0 , ≤ 1.4.4
(semver)
|
|
| wp_easy_post_types_project | wp_easy_post_types |
Affected:
0 , ≤ 1.4.4
(semver)
cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wp_easy_post_types_project:wp_easy_post_types:*:-:-:*:-:wordpress:*:*"
],
"defaultStatus": "unaffected",
"product": "wp_easy_post_types",
"vendor": "wp_easy_post_types_project",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T13:55:41.988153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T13:58:16.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Easy Post Types",
"vendor": "chertz",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the \u0027text\u0027 parameter in the \u0027ajax_import_content\u0027 function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:24:50.018Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d038f1a2-4755-417f-965d-508b57c05738?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L1318"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-10-17T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10079",
"datePublished": "2024-10-18T07:35:26.337Z",
"dateReserved": "2024-10-17T11:54:53.380Z",
"dateUpdated": "2026-04-08T17:24:50.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2014-4524 (GCVE-0-2014-4524)
Vulnerability from cvelistv5 – Published: 2014-07-02 18:00 – Updated: 2024-08-06 11:20
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://wordpress.org/plugins/easy-post-types/changelog | x_refsource_CONFIRM |
| http://codevigilant.com/disclosure/wp-plugin-easy… | x_refsource_MISC |
| https://plugins.trac.wordpress.org/changeset?sfp_… | x_refsource_MISC |
Date Public
2014-05-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:20:25.980Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://wordpress.org/plugins/easy-post-types/changelog"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-02T17:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://wordpress.org/plugins/easy-post-types/changelog"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4524",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://wordpress.org/plugins/easy-post-types/changelog",
"refsource": "CONFIRM",
"url": "http://wordpress.org/plugins/easy-post-types/changelog"
},
{
"name": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss",
"refsource": "MISC",
"url": "http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss"
},
{
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail=",
"refsource": "MISC",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=842687%40easy-post-types\u0026old=806912%40easy-post-types\u0026sfp_email=\u0026sfph_mail="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4524",
"datePublished": "2014-07-02T18:00:00.000Z",
"dateReserved": "2014-06-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T11:20:25.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}