113678 matches found
PT-2026-49222
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScrip...
PT-2026-49399
Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...
PT-2026-49343
Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.7.13 Description An unauthenticated PHP Object Injection exists in the software. PHP Object Injection occurs when user-supplied input is passed to the PHP unserialize function without proper validation,...
CVE-2026-49781: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in OttoKit = 1.1.27 versions...
CVE-2026-49769: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in wpForo Forum = 3.1.0 versions...
CVE-2026-49105: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...
CVE-2026-49085: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...
CVE-2026-39498: Deserialization of Untrusted Data
Shop manager PHP Object Injection in YayMail = 4.3.3 versions...
CVE-2026-39499: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Advanced Product Fields Product Addons for WooCommerce = 1.6.19 versions...
CVE-2026-39434: Deserialization of Untrusted Data
Shop manager PHP Object Injection in CTX Feed = 6.6.26 versions...
CVE-2026-39481: Deserialization of Untrusted Data
Author PHP Object Injection in Modula Image Gallery = 2.14.18 versions...
CVE-2026-42687: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EventPrime = 4.3.2.1 versions...
CVE-2026-39532: Deserialization of Untrusted Data
Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...
CVE-2026-38329
Bludit CMS versions prior to 3.18.4 are vulnerable to Remote Code Execution (RCE) within the API Plugin . The issue resides in the bl-plugins/api/plugin.php file, where the POST /api/files/{key} endpoint fails to perform adequate authorization checks and lacks file extension validation . Conseque...
CVE-2026-49768: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Happyforms = 1.26.13 versions...
CVE-2026-48157: Improper Neutralization of Input During Web Page Generation
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle and/or setDescription to include untrusted/request-derived data in the error title or description e.g. "No products found...
CVE-2026-9691: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 versions...
CVE-2026-49765: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.8 versions...
CVE-2026-49109: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.4.3 versions...