11605 matches found
CVE-2026-111628 10up Distributor before 2.3.2 PHP Object Injection via set_meta()
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...
EUVD-2026-103050
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection vulnerability
Authenticated Administrator+ PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Kirki versions = 6.3.2...
Security Bulletin: Multiple vulnerabilties in DevOps Test Hub
Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.9 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all...
WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin Strong Testimonials versions = 3.3.12...
WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by hinhlx in WordPress Plugin Conversational Forms for ChatBot versions = 1.5.1...
WordPress Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin <= 3.7.4 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...
CVE-2026-97296
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...
CVE-2026-104730
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP...
EUVD-2026-102810
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...
CVE-2026-97296 WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...
CVE-2026-97296
The Rocketgenius, Inc Gravity Forms WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data in the gravityforms component. This vulnerability affects versions prior to 3.1.1 . Successful exploitation could result in high impact across confidentiality, i...
CVE-2026-104730
The Sunshine Photo Cart WordPress plugin (versions up to and including 3.7.4 ) is vulnerable to PHP Object Injection due to the deserialization of untrusted input via the 'key' parameter . Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless a POP chain is...
CVE-2026-104730 Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP...
EUVD-2026-102796
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP...
CVE-2026-104932
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...
EUVD-2026-102679
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...
CVE-2026-104932
The Search Regex plugin for WordPress (version 3.5 and below) is vulnerable to PHP Object Injection due to the deserialization of untrusted input within the replace_all function. This flaw allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object, which can lead...
CVE-2026-104932 Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...
PT-2026-115523
Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.1 Description Rocketgenius, Inc Gravity Forms is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of a...