CVE-2025-9260

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated...

WordPress plugin LTL Freight Quotes – Day & Ross Edition 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2025-35772

Name of the Vulnerable Software and Affected Versions: LTL Freight Quotes - TQL Edition versions n/a through 1.2.6 Description: Deserialization of untrusted data in LTL Freight Quotes - TQL Edition allows for object injection. Recommendations: At the moment, there is no information about a newer...

WordPress plugin LTL Freight Quotes - TQL Edition 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Fluent Forms 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin LTL Freight Quotes – Daylight Edition 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-35771

Name of the Vulnerable Software and Affected Versions: LTL Freight Quotes – Daylight Edition versions through 2.2.7 Description: A deserialization of untrusted data issue exists in enituretechnology LTL Freight Quotes – Daylight Edition, allowing object injection. Recommendations: Update LTL...

PT-2025-35770

Name of the Vulnerable Software and Affected Versions: LTL Freight Quotes – Day & Ross Edition versions through 2.1.11 Description: Deserialization of untrusted data in LTL Freight Quotes – Day & Ross Edition allows object injection. Recommendations: At the moment, there is no information about a...

CVE-2025-9260 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated...

WordPress FluentForm plugin 5.1.16-6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read

Authenticated Subscriber+ PHP Object Injection To Arbitrary File Read vulnerability discovered by Webbernaut in WordPress Plugin FluentForm versions 5.1.16-6.1.1...

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by mcdruid in WordPress Plugin Client Invoicing by Sprout Invoices versions = 20.8.7...

PT-2025-35641

Name of the Vulnerable Software and Affected Versions: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress versions 5.1.16 through 6.1.1 Description: The plugin is susceptible to PHP Object Injection due to deserialization of untrusted input...

WordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Constant Contact for WordPress versions = 4.1.1...

CVE-2025-43960

Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service memory consumption via a crafted serialized payload e.g., using s:1000000000, leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which force...

CVE-2025-52761

Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager: from n/a through = 1.4.0...

CVE-2025-58218

Deserialization of Untrusted Data vulnerability in enituretechnology Small Package Quotes – USPS Edition small-package-quotes-usps-edition allows Object Injection.This issue affects Small Package Quotes – USPS Edition: from n/a through = 1.3.9...

CVE-2025-54742

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through = 4.4.8...

CVE-2025-54731

Improper Control of Generation of Code 'Code Injection' vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through = 3.5.1...

CVE-2025-53572

Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through = 4.0.1...

CVE-2025-53583

Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spotlight: from n/a through = 5.1.1...