CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

PT-2026-79744

Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.19 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the...

PT-2026-79589

Name of the Vulnerable Software and Affected Versions WS Form LITE – Drag & Drop Contact Form Builder versions prior to 1.10.81 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This occurs...

CVE-2026-4703: Deserialization of Untrusted Data

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

forminator-poc-lab

Forminator PoC validation lab This repository packages an iso...

CVE-2026-73993

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-66672

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66583

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73993

The WordPress FundEngine plugin (versions

EUVD-2026-63312

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

EUVD-2026-63303

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66672

The WordPress Flatastic theme (versions ≤ 2.0) is vulnerable to unauthenticated PHP Object Injection, exploitable over the network without credentials. The Patchstack advisory documents the issue; no exploit code or in-the-wild activity is reported. Affected sites should update to a patched theme...

CVE-2026-66583

CVE-2026-66583 is an unauthenticated PHP Object Injection vulnerability in the WordPress Forminator plugin , affecting versions

EUVD-2026-63332

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Theme FreightCo versions = 1.1.15...

WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability

Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...