3836 matches found
My Geo Posts Free <= 1.2 - PHP Object Injection
The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...
Better Search Replace < 1.4.5 - PHP Object Injection
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...
CVE-2026-16258
CVE-2026-16258 : The Ajax Search Lite WordPress plugin prior to 4.14.5 is vulnerable to deserialization of untrusted input, enabling unauthenticated PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite plugin before 4.14.5, this can be leveraged to ach...
EUVD-2026-54389
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-65581
The CVE-�2026-65581 entry concerns the WordPress AI ANN theme (<= 1.29.0) and describes an unauthenticated PHP Object Injection vulnerability. The connected documents corroborate the affected product and version range, with a focus on PHP object injection as the underlying issue. There are no ...
EUVD-2026-53878
Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...
CVE-2026-65579
CVE-2026-65579 describes an unauthenticated PHP Object Injection in the WordPress Agricola theme up to version 1.21.0. The affected component is the Agricola WordPress theme; the root cause is a PHP object injection vulnerability, enabling an attacker to achieve total compromise without authentic...
EUVD-2026-53995
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
CVE-2026-65576
CVE-2026-65576 affects WordPress Adrena theme <= 1.2.14. The issue is unauthenticated PHP Object Injection in the theme code, enabling high-impact impact per CVSS 3.1 metrics (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The connected sources confirm the vulnerability exists in Adrena
CVE-2026-65575 WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65576 WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65574 WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...