CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

EUVD-2026-76794

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-82845 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

CVE-2026-82845

The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) is vulnerable to PHP Object Injection due to the failure to prevent deserialization of user-supplied values held as metadata. An attacker with a minimal account can inject arbitrary PHP objects, leveraging a class in a bundled library to...

CVE-2026-82845 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

CVE-2026-84099: Deserialization of Untrusted Data

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-78175: Deserialization of Untrusted Data

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

PT-2026-90570

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

PT-2026-90578

Name of the Vulnerable Software and Affected Versions wpstorecart versions prior to 5.0.8 Description The plugin fails to prevent direct, unauthenticated access to a bundled add-on located at 'paypal.php' within the wpsc-membership-pro component. This allows unauthenticated attackers to inject...

WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...

CVE-2026-62107

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62105

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62103

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...

EUVD-2026-76212

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107

Masteriyo – LMS is a WordPress LMS plugin affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 3.4.0 . The flaw allows an attacker to inject a malicious serialized PHP object, potentially leading to full compromise of the site. The Patchstack CVSS 3.1 score is 8.8 (HIGH...

EUVD-2026-76197

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62105

CVE-2026-62105 affects the ThemeREX Addons WordPress plugin in versions prior to 2.45.0 , introducing an unauthenticated PHP Object Injection vulnerability. The flaw is exploitable over the network with low complexity, requires no privileges or user interaction, and is scored CVSS 3.1: 9.8 (Criti...