CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

EUVD-2026-69922

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin RTMKit versions = 2.1.5...

CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116

The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...

CVE-2026-84430

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...

CVE-2026-84430

gouguoa versions up to 5.10.0/6.0.1 contain a vulnerability in the edit_personal Endpoint (file app/home/controller/Index.php, function update). Manipulation of the position_id argument leads to dynamically-determined object attributes , enabling remote exploitation. The exploit has been publicly...

EUVD-2026-69794

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...

PT-2026-84609

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2023-3360: Deserialization of Untrusted Data

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

CVE-2026-81772: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

PT-2026-84691

Name of the Vulnerable Software and Affected Versions Ninja Forms - Layout & Styles versions prior to 3.0.32 Description An unauthenticated PHP Object Injection exists in the plugin. PHP Object Injection is a vulnerability that occurs when untrusted input is passed to the PHP unserialize function...

PT-2026-84708

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

PT-2026-84572

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit personal Endpoint. Such manipulation of the argument position id leads to dynamically-determined object...

CVE-2026-19116: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...