CVE-2026-9691 WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 versions...

CVE-2026-9691

The WordPress plugin “Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms” (vendor: WordPress ecosystem; affected component: PHP object injection vulnerability) is vulnerable in versions

WordPress Avada theme <= 3.15.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Theme Avada versions = 3.15.3...

WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Fusion Builder versions = 3.15.4...

PT-2026-49379

Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...

PT-2026-49380

Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall = 4.23.87 versions...

PT-2026-49513

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.8 versions...

PT-2026-49507

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...

CVE-2026-39478: Deserialization of Untrusted Data

Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall = 4.23.87 versions...

PT-2026-49378

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips 5.9.0 versions...

CVE-2026-39532: Deserialization of Untrusted Data

Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...

PT-2026-49385

Shop manager PHP Object Injection in YayMail = 4.3.3 versions...

PT-2026-49514

Unauthenticated PHP Object Injection in Happyforms = 1.26.13 versions...

CVE-2026-42687: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EventPrime = 4.3.2.1 versions...

CVE-2026-49106: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact = 1.1.6 versions...

CVE-2026-49781: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in OttoKit = 1.1.27 versions...

CVE-2026-49770: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

CVE-2026-49765: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.8 versions...

CVE-2026-49768: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Happyforms = 1.26.13 versions...

CVE-2026-49104: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.2.1 versions...