CVE-2025-53299 WordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmmcontentcomposer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through = 1.5.8...

CVE-2025-53299

CVE-2025-53299 describes a deserialization of untrusted data vulnerability in ThemeMakers Visual Content Composer (WordPress plugin) that enables PHP object injection. Affected versions are up to 1.5.8 (inclusive); the root cause is deserializing untrusted data, which can lead to object injection...

CVE-2025-53560 WordPress Noisa theme <= 2.6.0 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through = 2.6.0...

CVE-2025-53560 WordPress Noisa theme <= 2.6.0 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in rascals Noisa allows Object Injection. This issue affects Noisa: from n/a through 2.6.0...

CVE-2025-53560

CVE-2025-53560 affects WordPress Noisa theme versions up to 2.6.0, where deserialization of untrusted data enables PHP object injection. Patchstack indicates the fix is in 2.6.2; upgrading to Noisa 2.6.2+ is the recommended remediation. If upgrading is not possible, avoid deserializing untrusted ...

CVE-2025-54007 WordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through = 2.3.11...

CVE-2025-54007

CVE-2025-54007 affects WordPress Post Grid and Gutenberg Blocks (versions ≤ 2.3.11). Root cause is Deserialization of Untrusted Data leading to PHP Object Injection in the plugin’s handling of data, enabling potential full impact on confidentiality, integrity, and availability. CVSS v3.1 base sco...

CVE-2025-54007 WordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through = 2.3.11...

CVE-2025-54012 WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in nanbu Welcart e-Commerce allows Object Injection. This issue affects Welcart e-Commerce: from n/a through 2.11.16...

CVE-2025-54012 WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through = 2.11.16...

CVE-2025-54012

CVE-2025-54012 is a PHP object injection (deserialization of untrusted data) vulnerability in the WordPress plugin Welcart e-Commerce (versions up to 2.11.16). The affected component is Welcart e-Commerce itself, with root cause described as deserializing untrusted data leading to object injectio...

CVE-2025-54014 WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through = 15.1...

CVE-2025-54014

CVE-2025-54014 is a deserialization/ PHP Object Injection vulnerability in the MediCenter - Health Medical Clinic WordPress Theme (vulnerable:

CVE-2025-54014 WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic allows Object Injection. This issue affects MediCenter - Health Medical Clinic: from n/a through 15.1...

CVE-2025-54053

CVE-2025-54053 – Groundhogg PHP Object Injection . The vulnerability is caused by deserialization of untrusted data in Groundhogg (WordPress plugin) and is exploitable through versions up to and including 4.2.2. This leads to PHP object injection as described in external advisories. The Red Hat/P...

CVE-2025-54053 WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through = 4.2.2...

CVE-2025-54053 WordPress Groundhogg <= 4.2.2 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg allows Object Injection. This issue affects Groundhogg: from n/a through 4.2.2...

CVE-2025-8145

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the getleadfields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The addition...

CVE-2025-8289 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the deleteassociatedfiles function. This makes it possible for unauthenticated attackers to inject a PHP Object. This...

CVE-2025-8289

CVE-2025-8289 affects the WordPress plugin Redirection for Contact Form 7, vulnerable to unauthenticated PHP Object Injection via PHAR deserialization in delete_associated_files, for versions up to 3.2.4. Exploitation requires a form with a file upload action and the extension “Redirection For Co...