Skip to content
OpenAdvisories

Product · InstaWP

String locator

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2024-10936

    String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

    The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attack…

    InstaWP String locator Web / CMS
  • High 8.8
    CVE-2022-2434

    String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization

    The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, gr…

    InstaWP String locator Web / CMS