110011 matches found
PT-2026-103499
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
CVE-2026-91051: Deserialization of Untrusted Data
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
PT-2026-103039
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-93624: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
PT-2026-103490
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-102392: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-97256: Deserialization of Untrusted Data
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
CVE-2026-102377: Deserialization of Untrusted Data
Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...
CVE-2026-96831: Deserialization of Untrusted Data
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
CVE-2026-94678: Deserialization of Untrusted Data
Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...
CVE-2026-94122: Deserialization of Untrusted Data
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...
CVE-2026-94121: Deserialization of Untrusted Data
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
CVE-2026-94076: Deserialization of Untrusted Data
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...
CVE-2026-93771: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...
PT-2026-103507
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
PT-2026-103504
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
PT-2026-103163
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...
PT-2026-103171
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...