CVE-2026-96343: Deserialization of Untrusted Data

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96831: Deserialization of Untrusted Data

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

PT-2026-103216

Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...

CVE-2026-96832: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...

PT-2026-103244

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-97248: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-97291: Deserialization of Untrusted Data

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

PT-2026-103483

Name of the Vulnerable Software and Affected Versions Nested Pages versions prior to 3.3.3 Description Nested Pages is subject to a PHP Object Injection issue. This occurs when untrusted data is passed to the unserialize function, allowing an attacker to inject malicious objects into the...

CVE-2026-100512: Deserialization of Untrusted Data

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

CVE-2026-102377: Deserialization of Untrusted Data

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

PT-2026-103488

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-96833: Deserialization of Untrusted Data

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

PT-2026-103507

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-95531: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...

PT-2026-103039

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...