110415 matches found
CVE-2025-60205 WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...
CVE-2025-60205 WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...
Exploit for CVE-2026-7654
CVE-2026-7654...
CVE-2026-12115
The vulnerability CVE-2026-12115 affects the WordPress plugin Counter Box (versions up to 2.0.13). It allows PHP Object Injection via deserialization of untrusted input and requires authenticated access at Administrator+ level. Deserialization occurs automatically during the post-import redirect ...
CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
Exploit for CVE-2026-49952
setup pip3 install Pillow torch torchvision run...
CVE-2026-39554: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Fidalgo = 1.2.2 versions...
CVE-2025-69127: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
CVE-2026-40755: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
PT-2026-50407
Unauthenticated PHP Object Injection in Zoya = 1.4 versions...
CVE-2026-40754: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Roisin = 1.4 versions...
CVE-2026-39560: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...
CVE-2026-54194: Deserialization of Untrusted Data
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
CVE-2026-39578: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Valiance = 1.2 versions...
CVE-2026-40733: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
CVE-2026-40735: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reina = 2.1 versions...
CVE-2026-40751: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...
WordPress Theme: homeroofer: CVE-2025-58954: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in HomeRoofer = 2.11.0 versions...