WordPress String locator plugin < 2.6.8 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin String locator versions 2.6.8...

CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

EUVD-2026-94190

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188

The String locator WordPress plugin, in versions before 2.6.8 , is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the failure to restrict allowed classes during the deserialization of database row content saved via the plugin's database editor . This allows...

CVE-2026-97188: Deserialization of Untrusted Data

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

PT-2026-107413

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2022-0493

The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be...

EUVD-2022-34695

Malicious code in bioql PyPI...

EUVD-2023-59179

Malicious code in bioql PyPI...

WordPress String Locator plugin <= 2.6.6 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin String locator versions = 2.6.6...

CVE-2024-10936

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

CVE-2024-10936

CVE-2024-10936 relates to the WordPress String Locator plugin (versions up to 2.6.6). The vulnerability enables unauthenticated PHP Object Injection via deserialization in the recursive_unserialize_replace function. If a POP chain exists through another plugin/theme, an attacker could delete arbi...

CVE-2024-10936 String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

WordPress plugin String locator code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2024-10936: Deserialization of Untrusted Data

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

PT-2025-1615 · WordPress · String Locator

Name of the Vulnerable Software and Affected Versions: String Locator plugin for WordPress versions up to 2.6.6 Description: The String Locator plugin for WordPress is vulnerable to PHP Object Injection due to the deserialization of untrusted input in the recursive unserialize replace function...

WordPress String Locator plugin <= 2.6.5 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Rein Daelman trein in WordPress Plugin String locator versions = 2.6.5...

WordPress String locator Plugin <= 2.6.5 is vulnerable to Cross Site Scripting (XSS)

Software String locator Type Plugin Vulnerable versions = 2.6.5 Fixed in 2.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6987 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1314ec6116ff Credits Rein Daelman trein...