CVE-2025-47532 WordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through = 1.0.17...

CVE-2025-47530 WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through = 3.5.18...

CVE-2025-47530

CVE-2025-47530 concerns WordPress plugin WPFunnels (versions ≤ 3.5.18). Deserialization of untrusted data leads to PHP Object Injection . Reported with a CVSS v3.1 base score of 9.8 (Critical) and network attack vector with no user interaction. Public sources (Patchstack/Red Hat/NVD/CVEs) indicat...

CVE-2025-47530 WordPress WPFunnels <= 3.5.18 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels allows Object Injection. This issue affects WPFunnels: from n/a through 3.5.18...

CVE-2025-47532

CVE-2025-47532 is a deserialization of untrusted data vulnerability in the WordPress CoinPayments.net Payment Gateway for WooCommerce. Affected software: CoinPayments.net Payment Gateway for WooCommerce up to and including version 1.0.17. Root cause: PHP object injection via deserialization of un...

CVE-2025-47568 WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through = 6.91...

CVE-2025-47568

The CVE-2025-47568 refers to a Deserialization of Untrusted Data vulnerability in the ZoomSounds WordPress plugin (ZoomSounds

CVE-2025-47568 WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds allows Object Injection. This issue affects ZoomSounds: from n/a through 6.91...

CVE-2025-47660 WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through = 2.16...

CVE-2025-47660

CVE-2025-47660 is a deserialization of untrusted data vulnerability (PHP Object Injection) in the WordPress plugin WC Affiliate by Codexpert. Affected versions are listed as from n/a through 2.9.1, with related sources noting a broader reference set including WC Affiliate

CVE-2025-47660 WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through = 2.16...

CVE-2025-48289 WordPress Kids Planet theme <= 2.2.14 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through = 2.2.14...

CVE-2025-48287 WordPress Pix 4x sem juros - Pagaleve <= 1.6.9 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through 1.6.9...

CVE-2025-48289 WordPress Kids Planet <= 2.2.14 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet allows Object Injection. This issue affects Kids Planet: from n/a through 2.2.14...

CVE-2025-48287 WordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through = 1.6.9...

CVE-2025-48289

CVE-2025-48289 (WordPress Kids Planet) : Deserialization of untrusted data leading to PHP object injection in AncoraThemes Kids Planet, affecting versions up to 2.2.14. CVSS 3.1 base score 9.8 (CRITICAL) with high impact on confidentiality, integrity, and availability. Connected sources indicate ...

CVE-2025-48287

CVE-2025-48287 affects the WordPress plugin Pix 4x sem juros – Pagaleve (versions up to 1.6.9). It is a Deserialization of Untrusted Data vulnerability enabling PHP Object Injection. The CVSS v3.1 base score is 9.8 (Critical). Patch status in connected sources indicates the issue has been patched...

CVE-2024-1858

The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via deserialization of untrusted input through post meta data. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2024-5488

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present...

CVE-2025-4803

The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with...