Kalles Addons
Monthly
PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.