CVE-2023-46615

CVE-2023-46615 KD Coming Soon = 1.7 - Unauthenticated PHP Object Injection via cetitle Description: The KD Coming Soon plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7 via deserialization of untrusted input cetitle in the vulnerable kdcemailer...

CVE-2022-21661

🛡️ CVE-2022-21661 A Proof-of-Concept PoC exploit written in Python for CVE-2022-21661, which is a critical vulnerability in WordPress that allows an unauthenticated attacker to perform an object injection attack , which under certain conditions can lead to Remote Code Execution RCE. This...

jsPDF-Object-Injection

CVE-2026-25755 サンドボックスをバイパスするjsPDFの欠陥によるオブジェクトインジェクション 概要 jsPDF（クライアントサイドアプリケーションでPDF文書を生成するために広く使用されているJavaScriptライブラリ）において、重大なPDFオブジェクトインジェクションの脆弱性（CVE-2026-25755）が発見されました。この脆弱性はaddJS関数に存在し、不適切な入力サニタイズにより、攻撃者が任意のPDFオブジェクトを注入し、AcroJSサンドボックスの制限をバイパスすることが可能になります。 根本原因...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

EUVD-2026-74608

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363

CVE-2026-11363 affects the Ninja Forms WordPress plugin (all versions ≤ 3.14.6) with an authenticated PHP Object Injection vulnerability. During form import, WPN_Helper::build_nf_cache() calls $action->get_settings(), triggering deserialization of untrusted input with no further user interacti...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 脆弱性ラボ 概要 このラボ環境は、Better Search Replace WordPress プラグイン（バージョン ≤1.4.4）における重大な PHP オブジェクトインジェクション脆弱性 CVE-2023-6933 を実演します。 脆弱性の詳細 CVE ID : CVE-2023-6933 CVSS スコア : 9.8（緊急） 影響を受けるプラグイン : Better Search Replace ≤1.4.4 脆弱性タイプ : 非シリアル化されたユーザー入力による PHP オブジェクトインジェクション 攻撃ベクトル : AJAX エンドポイント...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injection → RCE PoC for remote code execution inOpenSTAManager ≤ 2.10.1. oauth2.php looks up a zzoauth2 row by the attacker-controlled state GET parameter and calls unserialize on its accesstoken column without anallowedclasses restriction...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 RCE (ESA-2026-114)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-114 advisory. - Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4...

WordPress Live Composer – Free WordPress Website Builder plugin <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Page Builder: Live Composer versions = 2.1.18...

CVE-2026-10196

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

EUVD-2026-71991

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196

The Mail Mint WordPress plugin (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) is affected by an unauthenticated PHP Object Injection in all versions up to and including 1.31.0 . The root cause is deserialization of untrusted input in the handle_form_submission function, whic...