79 matches found
CVE-2026-16267
The Newsletters WordPress plugin (versions prior to 4.16 ) is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the software's failure to restrict the classes allowed during the unserialization of values received from public form submissions. This flaw allows ...
CVE-2026-65581
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-65579
Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-65572
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
CVE-2026-65556
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
CVE-2026-65581 WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-65578 WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-65577 WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
CVE-2026-65572
The CVE-2026-65572 entry concerns the WordPress A.Williams theme (versions
CVE-2026-65573
CVE-2026-65573 is an unauthenticated PHP Object Injection vulnerability affecting the WordPress theme Abelle in versions 1.22 and earlier . The connected documents consistently describe the issue as a PHP Object Injection vulnerability that does not require authentication, with impact metrics ind...
EUVD-2026-53991
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
EUVD-2026-53989
Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...
WordPress ChamaWP plugin < 1.0.13 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ChamaWP versions 1.0.13...
CVE-2025-15672 Chama < 1.0.13 - Unauthenticated PHP Object Injection
The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...
CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...
CVE-2026-57677
Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce = 12.10.3 versions...
CVE-2026-57677 WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce = 12.10.3 versions...
