WordPress plugin Modal Popup Box 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There we...

WordPress plugin Slider Responsive Slideshow – Image slider, Gallery slideshow 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress plugin PatioTime 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

WordPress plugin Themesflat Elementor 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. The themes...

PT-2026-21197

Name of the Vulnerable Software and Affected Versions A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow versions through 1.5.4 Description The software contains a flaw related to the deserialization of untrusted data, which allows for object injection. This issue impacts...

WordPress plugin Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-21144

Name of the Vulnerable Software and Affected Versions Jthemes Prestige versions prior to 1.4.1 Description The software contains a flaw due to deserialization of untrusted data, which can lead to object injection. Recommendations Update Jthemes Prestige to version 1.4.1 or later...

PT-2026-21128

Name of the Vulnerable Software and Affected Versions PhotoMe versions n/a through 5.6.11 Description A flaw exists in PhotoMe that allows for object injection due to deserialization of untrusted data. This issue impacts the application's ability to securely handle incoming data, potentially...

PT-2026-21094

Name of the Vulnerable Software and Affected Versions Ippsum versions through 1.2.0 Description A flaw exists in Ippsum that allows for object injection due to deserialization of untrusted data. This condition can be exploited by an attacker to potentially compromise the system. Recommendations...

WordPress plugin Travelicious 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

WordPress plugin ModelTheme Addons for WPBakery and Elementor 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

WordPress plugin SevenHills 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

PT-2026-21064

Name of the Vulnerable Software and Affected Versions BoldThemes Nestin versions prior to 1.2.6 Description A flaw exists in BoldThemes Nestin that allows for object injection due to deserialization of untrusted data. This issue could potentially allow an attacker to compromise the system...

PT-2026-21152

Name of the Vulnerable Software and Affected Versions AncoraThemes KindlyCare versions through 1.6.1 Description An issue exists in AncoraThemes KindlyCare that allows for Object Injection due to deserialization of untrusted data. Recommendations Update KindlyCare to a version later than 1.6.1...

CVE-2026-25940

A flaw was found in jsPDF. The properties and methods of the Acroform module accept user input without sanitization, allowing an attacker to inject arbitrary PDF objects, such as JavaScript actions. Specifically, if an attacker can supply a specially crafted input to the...

Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Description The zumba/json-serializer library allows deserialization of PHP objects from JSON using a special @type field. Prior to version 3.2.3, the deserializer would instantiate any class specified in the @type field without restriction. When processing untrusted JSON input, this behavior may...

GHSA-V7M3-FPCR-H7M2 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Description The zumba/json-serializer library allows deserialization of PHP objects from JSON using a special @type field. Prior to version 3.2.3, the deserializer would instantiate any class specified in the @type field without restriction. When processing untrusted JSON input, this behavior may...

CVE-2026-25755

A flaw was found in jsPDF. The addJS method accepts user input without proper sanitization, allowing an attacker to inject arbitrary PDF objects into the document. A specially crafted payload that escapes the JavaScript string delimiter can execute malicious actions or alter the document structur...

jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

Impact User control of the argument of the addJS method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the addJS method. An attacker can inject arbitrary PDF objects and execute malicious actions or alter the document structure by supplying specially crafted input that escapes the JavaScript...