10524 matches found
PT-2026-82873
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
PT-2026-83084
Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.7.2 Description An issue involving the deserialization of untrusted data allows for PHP object injection, which can be chained from an unauthenticated starting point to achieve remote code execution. The attack...
PT-2026-84027
Name of the Vulnerable Software and Affected Versions Tickera versions prior to 3.6.0.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects a...
CVE-2026-82222: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1...
CVE-2026-78286
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292
CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions
EUVD-2026-66946
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78286
CVE-2026-78286 affects the WordPress Geo Controller plugin in versions ≤ 8.9.8 . The vulnerability is an unauthenticated PHP Object Injection , meaning an attacker can trigger it over the network without any credentials or user interaction. The CNA (Patchstack) assigned a CVSS 3.1 score of 9.8 (C...
EUVD-2026-66943
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78286 WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
EUVD-2026-66939
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276
CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...