EUVD-2026-26750

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-1235

The vulnerability CVE-2026-1235 affects the WP eCommerce WordPress plugin (up to version 3.15.1). It arises from unserializing user input via ajax actions, enabling PHP Object Injection when a suitable gadget is present on the blog. Impact is unauthenticated access to trigger the issue; exploitat...