PatchTheCVE: optiontree projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-15321: The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandlhttps://patchthecve.com/cve/CVE-2019-15321.htmlhttps://patchthecve.com/cve/CVE-2019-15321.htmlWed, 17 Jun 2026 02:20:05 +0000CRITICAL 9.8: The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-15320: The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.https://patchthecve.com/cve/CVE-2019-15320.htmlhttps://patchthecve.com/cve/CVE-2019-15320.htmlWed, 17 Jun 2026 02:20:05 +0000CRITICAL 9.8: The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-15319: The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.https://patchthecve.com/cve/CVE-2019-15319.htmlhttps://patchthecve.com/cve/CVE-2019-15319.htmlWed, 17 Jun 2026 02:20:05 +0000CRITICAL 9.8: The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2016-10895: The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX requeshttps://patchthecve.com/cve/CVE-2016-10895.htmlhttps://patchthecve.com/cve/CVE-2016-10895.htmlWed, 17 Jun 2026 00:40:34 +0000MEDIUM 6.1: The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2015-9320: The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.https://patchthecve.com/cve/CVE-2015-9320.htmlhttps://patchthecve.com/cve/CVE-2015-9320.htmlWed, 17 Jun 2026 00:36:17 +0000MEDIUM 6.1: The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.