OptionTree

OptionTree has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; 5 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 3 high. 2019 was the busiest year with 4 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 4 of the records (67%). Other recurring categories include Cross-Site Scripting.

5 of the records (83%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

All of these findings were reported by Ananda Dhakal.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage83%

Open

Fixed

Get automatic notifications for all OptionTree vulnerabilities before they are exploited.

Most severe open issueCVSS 6.6CVE-2026-66620

OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection

Read the full analysis

Vulnerability Records

6 records


2026-08-18 00:00	OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection OptionTree <= 2.7.3	`CVE-2026-66620`	6.6 Medium	Ananda Dhakal	No
2019-08-16 00:00	Option Tree <= 2.5.5 - Cross-Site Scripting OptionTree <= 2.5.5	`CVE-2016-10895`	6.1 Medium	Anonymous	Yes
2019-05-19 00:00	Option Tree <= 2.7.2 - Object Injection Bypass OptionTree <= 2.7.2	`CVE-2019-15320`	8.1 High	Anonymous	Yes
2019-05-19 00:00	Option Tree <= 2.7.2 - Object Injection Bypass OptionTree <= 2.7.2	`CVE-2019-15321`	8.1 High	Anonymous	Yes
2019-04-16 00:00	Option Tree <= 2.6.0 - PHP Object Injection OptionTree <= 2.6.0	`CVE-2019-15319`	8.1 High	Anonymous	Yes
2015-04-22 00:00	Option Tree <= 2.5.3 - Cross-Site Scripting OptionTree <= 2.5.3	`CVE-2015-9320`	6.1 Medium	Anonymous	Yes

Showing 1–6 of 6 reports