WordPress option-tree has 5 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-15319 | The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. | critical | 9.8 | <2.7.0 | 2.7.0 |
| CVE-2019-15320 | The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. | critical | 9.8 | <2.7.3 | 2.7.3 |
| CVE-2019-15321 | The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. | critical | 9.8 | <2.7.3 | 2.7.3 |
| CVE-2015-9320 | The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. | medium | 6.1 | <2.5.4 | 2.5.4 |
| CVE-2016-10895 | The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. | medium | 6.1 | <2.6.0 | 2.6.0 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked