CVE-2026-24974 WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through = 3.7.1...

CVE-2026-24378

CVE-2026-24378 describes a Deserialization of Untrusted Data flaw in EventPrime (Events Calendar, Bookings and Tickets) that enables unauthenticated PHP object injection. Affected: EventPrime

CVE-2026-24378 WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through = 4.2.8.0...

CVE-2026-23971

CVE-2026-23971 concerns a Deserialization of Untrusted Data vulnerability in the WordPress WoodMart theme (WoodMart) affecting versions from unknown up to and including 8.3.8. The underlying issue is PHP Object Injection via untrusted data deserialization, with a high impact profile (CVSS 3.1: 8....

CVE-2026-23971 WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through = 8.3.8...

CVE-2026-22510

CVE-2026-22510 is a real DESERIALIZATION vulnerability in the WordPress Melody theme (melodyschool), affecting Melody versions up to and including 1.6.3. The root cause is deserialization of untrusted data that enables PHP object injection. The CVSS base score is 8.1 (HIGH) with network attack ve...

CVE-2026-22510 WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through = 1.6.3...

CVE-2026-22507

CVE-2026-22507 describes a Deserialization of Untrusted Data vulnerability in the WordPress theme Beelove (AncoraThemes Beelove) up to version 1.2.6, allowing PHP object injection. Red Hat and ENISA ENISA-ENISA pages corroborate the same description. The issue affects Beelove: from n/a through

CVE-2026-22500 WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through = 1.1.2...

CVE-2026-22480 WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through = 2.3.3...

PT-2026-28026

Name of the Vulnerable Software and Affected Versions Pelicula versions prior to 1.10 Description The Pelicula software contains a flaw related to the deserialization of untrusted data, which can lead to object injection. This issue impacts the pelicula-video-production-and-movie-theme...

PT-2026-28024

Name of the Vulnerable Software and Affected Versions Kamperen versions prior to 1.3 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations At the moment, there is no information about a newer version that contains a f...

PT-2026-28020

Name of the Vulnerable Software and Affected Versions Archicon versions prior to 1.7 Description A flaw exists in Archicon that allows for object injection due to deserialization of untrusted data. This issue impacts the software's ability to securely handle data, potentially leading to...

PT-2026-27857

Name of the Vulnerable Software and Affected Versions Metagauss EventPrime versions through 4.2.8.0 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts the eventprime-event-calendar-management component...

PT-2026-27920

Name of the Vulnerable Software and Affected Versions rascals Pendulum versions prior to 3.1.5 Description An issue exists in rascals Pendulum that allows for Object Injection due to deserialization of untrusted data. This impacts the Pendulum software. Recommendations Update to a version of...

PT-2026-27888

Name of the Vulnerable Software and Affected Versions KIDZ versions n/a through 5.24 Description An issue exists in park of ideas KIDZ kidz that allows for object injection due to deserialization of untrusted data. This could potentially allow for malicious code execution. Recommendations Version...

PT-2026-27877

Name of the Vulnerable Software and Affected Versions FantasticPlugins SUMO Affiliates Pro versions prior to 11.4.0 Description An issue exists in FantasticPlugins SUMO Affiliates Pro related to the deserialization of untrusted data, which can lead to object injection. The affected component is...

PT-2026-27869

Name of the Vulnerable Software and Affected Versions NooTheme Organici Library versions n/a through 2.1.2 Description An issue exists in NooTheme Organici Library that allows for object injection due to deserialization of untrusted data. This impacts the noo-organici-library. Recommendations...

PT-2026-27867

Name of the Vulnerable Software and Affected Versions NooTheme CitiLights versions through 3.7.1 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update NooTheme CitiLights to a version later than 3.7.1...

PT-2026-27822

Name of the Vulnerable Software and Affected Versions axiomthemes m2 | Construction and Tools Store versions n/a through 1.1.2 Description An issue exists in axiomthemes m2 | Construction and Tools Store that allows for object injection due to deserialization of untrusted data. This impacts the...