110340 matches found
PT-2026-103022
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
PT-2026-103215
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
PT-2026-103504
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
CVE-2026-96831: Deserialization of Untrusted Data
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
CVE-2026-93651: Deserialization of Untrusted Data
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...
CVE-2026-94683: Deserialization of Untrusted Data
Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...
CVE-2026-93771: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...
PT-2026-103217
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-97256: Deserialization of Untrusted Data
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
CVE-2026-96344: Deserialization of Untrusted Data
Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...
CVE-2026-97248: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-96343: Deserialization of Untrusted Data
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
PT-2026-103182
Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...
PT-2026-103216
Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...
PT-2026-103244
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-94121: Deserialization of Untrusted Data
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
CVE-2026-97291: Deserialization of Untrusted Data
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
CVE-2026-91051: Deserialization of Untrusted Data
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...