PT-2026-77047

Name of the Vulnerable Software and Affected Versions FundEngine versions prior to 1.8.0 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects...

...[ More ]

A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28149

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-27380

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176

CVE-2026-28176 involves the WordPress Booking Activities plugin (

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

EUVD-2026-57959

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28149

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28149

The CVE-2026-28149 entry covers an Unauthenticated PHP Object Injection in the WordPress Headless Single Sign On plugin versions &lt;= 1.6. The underlying issue is a PHP object injection vulnerability that can be exploited without authentication, leading to high impact on confidentiality, integri...

EUVD-2026-57947

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-27380

CVE-2026-27380 affects the WordPress Car Rental Manager plugin

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

EUVD-2026-57932

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...