EUVD-2026-96221

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-lev...

CVE-2026-104723

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

EUVD-2026-96108

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104723

The LifterLMS WordPress plugin (versions

CVE-2026-104398: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10...

CVE-2026-62054: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Yacht Rental = 2.6 versions...

CVE-2026-62053: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Wine House = 3.20 versions...

CVE-2026-62052: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tipsy = 1.6 versions...

CVE-2026-62051: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Stargaze = 1.10 versions...

CVE-2026-62050: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Splendour = 1.23 versions...

CVE-2026-62046: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12...

CVE-2026-62045: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0...

CVE-2026-62044: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13...

CVE-2026-62077: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Avala = 1.1.4 versions...

CVE-2026-62021: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-62130: Deserialization of Untrusted Data

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...

CVE-2026-62125: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Asia Garden = 1.3.1 versions...

CVE-2026-62120: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Law Office = 3.20 versions...

CVE-2026-94676: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0...