CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

EUVD-2026-88469

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 3.6.3 . The flaw exists in the cp_display_preview_modal AJAX action because the nonce guard fails open when the cp_admin_page_nonce parameter is omitted, and there is no capability check on ...