CVE-2026-32470: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

PT-2026-77086

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

PT-2026-77132

Name of the Vulnerable Software and Affected Versions TaxoPress versions prior to 3.51.1 Description TaxoPress is subject to an object injection issue caused by the deserialization of untrusted data. This occurs when the application processes specially crafted serialized data, allowing an attacke...

CVE-2026-73341: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-32465: Deserialization of Untrusted Data

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-73366: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-77056

Name of the Vulnerable Software and Affected Versions OptionTree versions prior to 2.7.4 Description PHP Object Injection occurs when untrusted data is passed to the unserialize function, allowing an attacker to manipulate serialized objects and potentially execute arbitrary code. Recommendations...

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions = 1.13.0...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2024-55720

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-10035

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...

CVE-2026-10035 Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...

CVE-2026-10035

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...

CVE-2026-10035

Turnkey bbPress by WeaverTheme for WordPress is affected up to version 1.7.1. The vulnerability is PHP Object Injection via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (triggered through the wvrbbp_save_restore() handler). The function reads the raw conten...