11237 matches found
WordPress Ajax Search Lite PHP Object Injection Vulnerability
WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...
PT-2026-71025
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
CVE-2026-18391: Unrestricted Upload of File with Dangerous Type
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
WordPress 69: PHP Object Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress 69 Clothing has a PHP object injection vulnerability, which stems from the lack of security checks on deserialized data by the program. Attackers can exploit this vulnerability to...
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in QOS.CH Sarl logback
Summary Multiple vulnerabilities in QOS.CH Sarl logback that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core...
WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...
WordPress Grand Car Rental theme <= 3.7.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Car Rental versions = 3.7.2...
CVE-2026-16267
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
EUVD-2026-54729
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
CVE-2026-16267
The Newsletters WordPress plugin versions prior to 4.16 is vulnerable to PHP Object Injection . The root cause is the failure to restrict allowed classes when unserialising values received from public form submissions, specifically via a date form field . This allows unauthenticated attackers to ...
CVE-2026-16267
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
PT-2026-69168
Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.16 Description An issue exists where the software fails to restrict the classes allowed during the unserialization of values received from public form submissions. This allows unauthenticated...
EUVD-2026-54389
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-16258
The Ajax Search Lite WordPress plugin (versions before 4.14.5 ) is vulnerable to PHP Object Injection due to the insecure deserialization of untrusted input. This flaw is specifically located in the Search Statistics REST Endpoint . An unauthenticated attacker can exploit this to achieve Remote C...
CVE-2026-16258
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-16258 Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
PT-2026-68870
Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description An issue exists where the software fails to prevent the deserialization of untrusted input, enabling unauthenticated attackers to perform PHP Object Injection. This occurs via the Search...
CVE-2026-16258: Deserialization of Untrusted Data
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...