CVE-2026-62105

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107

Masteriyo – LMS is a WordPress LMS plugin affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 3.4.0 . The flaw allows an attacker to inject a malicious serialized PHP object, potentially leading to full compromise of the site. The Patchstack CVSS 3.1 score is 8.8 (HIGH...

CVE-2026-62105

CVE-2026-62105 affects the ThemeREX Addons WordPress plugin in versions prior to 2.45.0 , introducing an unauthenticated PHP Object Injection vulnerability. The flaw is exploitable over the network with low complexity, requires no privileges or user interaction, and is scored CVSS 3.1: 9.8 (Criti...

CVE-2026-62103

CVE-2026-62103 affects the WordPress Everest Forms plugin in versions 3.6.0 and earlier . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) by Patchstack, with high impact on confidentiality, integrity, and availability. No user interaction is required. A si...

CVE-2026-62103 WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62105 WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2025-22510

CVE-2025-22510 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WC Price History for Omnibus Vulnerable version To activate this plugin, the WooCommerce plugin must first be installed and activated. 2. To test the PHP Object Inj...

CVE-2025-43960

CVE-2025-43960 - PHP Object Injection in Adminer 4.8.1 via Monolog - Denial of Service DoS After months of waiting for a response from MITRE, I obtained CVE-2025-43960 with a PHP Object Injection attack against the Adminer service 4.8.1, causing a Denial of Service DoS through Memory Manipulation...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

CVE-2019-6340

CVE-2019-6340 For educational purposes only Run root@kitploit: $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 Exploit GET root@kitploit: $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...

Joomla_CVE-2015-8562

JoomlaCVE-2015-8562 A proof of concept for Joomla's CVE-2015-8562 vulnerability Object Injection RCE Intro/Changelog This PoC is the second version of the implementation hosted at exploit-db. root@kitploit: -Fixed regenerate session -Added the option to switch from X-Forwarded-For to User-Agent...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit By Chirag Artani Overview This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution RCE vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation...

CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Authenticated Subscriber+ PHP Object Injection Description The ARPrice plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.0.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, wi...

CVE-2024-12877

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...