4052 matches found
EUVD-2026-63303
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66672
The WordPress Flatastic theme (versions ≤ 2.0) is vulnerable to unauthenticated PHP Object Injection, exploitable over the network without credentials. The Patchstack advisory documents the issue; no exploit code or in-the-wild activity is reported. Affected sites should update to a patched theme...
CVE-2026-66583
CVE-2026-66583 is an unauthenticated PHP Object Injection vulnerability in the WordPress Forminator plugin , affecting versions
EUVD-2026-63332
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Theme FreightCo versions = 1.1.15...
WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability
Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...
PT-2026-78976
Name of the Vulnerable Software and Affected Versions Flatastic versions prior to 2.1 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects and...
CVE-2026-73389
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73364
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73389
CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...
EUVD-2026-62390
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
EUVD-2026-62384
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73364
WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...
WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...
WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...
PT-2026-78346
Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objec...