CVE-2024-11465

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-12313

CVE-2024-12313 : The Compare Products for WooCommerce plugin for WordPress is vulnerable to unauthenticated PHP Object Injection in all versions up to 3.2.1 via deserialization of untrusted input from the woo_compare_list cookie. The vulnerability allows an attacker to inject a PHP Object. The de...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-11465

CVE-2024-11465 affects the Custom Product Tabs for WooCommerce plugin for WordPress (

WordPress plugin Custom Product Tabs for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2025-3254 · Unknown · Plaininventory

Name of the Vulnerable Software and Affected Versions: PlainInventory versions 3.1.6 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can be exploited due to the vulnerability in handling data deserialization...

WordPress plugin Compare Products for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

PT-2025-3246 · Unknown · Locatoraid Store Locator

Name of the Vulnerable Software and Affected Versions: Locatoraid Store Locator versions n/a through 3.9.50 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially lead to security breaches by injecting malicious objects into...

PT-2025-1811 · WordPress · Compare Products For Woocommerce

Name of the Vulnerable Software and Affected Versions: Compare Products for WooCommerce plugin for WordPress versions up to, and including, 3.2.1 Description: The issue concerns a PHP Object Injection vulnerability in the Compare Products for WooCommerce plugin for WordPress. This vulnerability...

WordPress Custom Product Tabs for WooCommerce plugin <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection vulnerability

Authenticated Shop Manager+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Custom Product Tabs for WooCommerce versions = 1.8.5...

WordPress UpdraftPlus plugin <= 1.24.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin UpdraftPlus versions = 1.24.11...

CVE-2024-10957

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursiveunserializedreplace' function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2024-10957 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursiveunserializedreplace' function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2024-10957

CVE-2024-10957 affects UpdraftPlus: WP Backup & Migration Plugin (versions 1.23.8–1.24.11). It provides an unauthenticated PHP Object Injection via deserialization in recursive_unserialized_replace. No POP chain is present by default; exploitation requires a POP chain from another plugin/theme in...

CVE-2024-10957 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursiveunserializedreplace' function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2024-10932

The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The...

CVE-2024-10932 Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'

The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The...