CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551

PPWP – Password Protect Pages (WordPress plugin) is vulnerable to PHP Object Injection in all versions up to and including 1.9.18 . The flaw stems from deserialization of untrusted input via the post_protection_roles parameter, exploitable by any authenticated user with Contributor-level access o...

CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-4703

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

phpstan v2.2.9

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

EUVD-2026-64521

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

CVE-2026-4703

WS Form LITE (WordPress plugin) versions up to and including 1.10.80 are vulnerable to unauthenticated PHP Object Injection caused by deserialization of untrusted input from form submission meta values. The plugin itself contains no known POP chain, so the vulnerability has no direct impact unles...

CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

CVE-2026-76604

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

EUVD-2026-64320

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.3 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76604

Fabrik is a Joomla extension (by fabrikar.com) that allows building forms and databases. In versions below 4.7.3 , the PHP form element permits execution of user-supplied code, enabling unauthenticated remote code execution over the network with no user interaction required. The CVSS 4.0 score is...

CVE-2026-76604 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-76604 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

php: Fix of 2 CVEs

CVE-2026-7260: fix stack exhaustion via unbounded recursion on circular symlinks in phar archives - CVE-2026-9672: fix use of uninitialised LZW table data in bundled libgd GIF decoder...

PT-2026-79580

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description An unauthenticated remote code execution issue exists within the PHP form element, which allows the execution of user-provided code. Recommendations Update to version 4.7.3 or later. As a temporary...

PT-2026-79589

Name of the Vulnerable Software and Affected Versions WS Form LITE – Drag & Drop Contact Form Builder versions prior to 1.10.81 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This occurs...

CVE-2026-76604: Improper Control of Generation of Code

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes...

CVE-2026-4703: Deserialization of Untrusted Data

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

PT-2026-79744

Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.19 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the...