String locator vulnerabilities

2 known vulnerabilities in String locator from InstaWP. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  String locator: Deserialization of Untrusted Data

  CVE-2024-10936Jan 21, 2025InstaWPEPSS 1.14%

  The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attacke

• 8.8 High severity

  String locator: Deserialization of Untrusted Data

  CVE-2022-2434Sep 6, 2022InstaWPEPSS 1.62%

  The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, gra