10909 matches found
PT-2026-103039
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-93651: Deserialization of Untrusted Data
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...
PT-2026-103182
Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...
PT-2026-103483
Name of the Vulnerable Software and Affected Versions Nested Pages versions prior to 3.3.3 Description Nested Pages is subject to a PHP Object Injection issue. This occurs when untrusted data is passed to the unserialize function, allowing an attacker to inject malicious objects into the...
PT-2026-103490
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-100512: Deserialization of Untrusted Data
Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...
CVE-2026-97256: Deserialization of Untrusted Data
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
CVE-2026-102377: Deserialization of Untrusted Data
Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...
CVE-2026-97248: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
CVE-2026-97246: Deserialization of Untrusted Data
Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...
CVE-2026-96832: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...
CVE-2026-96831: Deserialization of Untrusted Data
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
CVE-2026-96344: Deserialization of Untrusted Data
Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...
CVE-2026-96343: Deserialization of Untrusted Data
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
CVE-2026-94683: Deserialization of Untrusted Data
Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...
CVE-2026-94678: Deserialization of Untrusted Data
Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...
CVE-2026-94122: Deserialization of Untrusted Data
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...
CVE-2026-94121: Deserialization of Untrusted Data
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...