111739 matches found
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
EUVD-2026-89618
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
EUVD-2026-89639
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
CVE-2026-75823
The User Frontend WordPress plugin (versions 3.5.29 through 4.3.11 ) contains a vulnerability allowing unauthenticated privilege escalation . The root cause is a failure to prevent tampering with the role assigned by the plugin's registration form. This specifically affects installations where a ...
CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
AZL-105639 CVE-2026-103111 affecting package php 8.3.33-1
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...
CLEANSTART-2026-AP36720 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings
Security vulnerability affects the tempo package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...
EUVD-2026-89469
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
PT-2026-103329
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results ...
PT-2026-103507
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
PT-2026-103171
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...
PT-2026-103170
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
PT-2026-103242
Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer versions prior to 6.5.6 Description ShortPixel Image Optimizer contains a flaw involving the deserialization of untrusted data, which allows Object Injection. Object Injection occurs when an application deserializes ...
CVE-2026-97248: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-97246: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5...
CVE-2026-96833: Deserialization of Untrusted Data
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...