WordPress plugin CoSchool LMS 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-29786 · Telegram · Site Chat On Telegram

Name of the Vulnerable Software and Affected Versions: Site Chat on Telegram versions n/a through 1.0.4 Description: A deserialization of untrusted data issue exists in Site Chat on Telegram, potentially allowing object injection. Recommendations: Update Site Chat on Telegram to a version later...

PT-2025-29736 · Unknown · Jetformbuilder

Name of the Vulnerable Software and Affected Versions: JetFormBuilder versions n/a through 3.5.1.2 Description: JetFormBuilder is susceptible to a deserialization of untrusted data issue, enabling object injection. Recommendations: JetFormBuilder versions prior to 3.5.1.2 are affected. At the...

WordPress plugin Site Chat on Telegram 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

WordPress plugin JetFormBuilder 代码问题漏洞

WordPress JetFormBuilder is a free plugin for the WordPress platform, mainly used to quickly build all kinds of forms through a drag-and-drop interface, supporting the Gutenberg editor design. WordPress JetFormBuilder has a deserialization vulnerability that stems from deserializing untrustworthy...

PT-2025-29777 · Nootheme · Nootheme Yogi

Name of the Vulnerable Software and Affected Versions: NooTheme Yogi versions through 2.9.0 Description: The software contains a deserialization of untrusted data flaw that allows for object injection. Recommendations: Update NooTheme Yogi to a version later than 2.9.0...

WordPress plugin URL Shortener 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Visual Art | Gallery WordPress Theme 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-29793 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: designthemes Visual Art | Gallery WordPress Theme versions through 2.4 Description: The designthemes Visual Art | Gallery WordPress Theme contains a flaw due to deserialization of untrusted data, allowing for object injection. Recommendations...

PT-2025-29776 · Awethemes · Hillter

Name of the Vulnerable Software and Affected Versions: awethemes Hillter versions through 3.0.7 Description: The software contains a deserialization of untrusted data flaw that allows for object injection. Recommendations: Update awethemes Hillter to a version later than 3.0.7...

PT-2025-29789 · Unknown · Coschool Lms

Name of the Vulnerable Software and Affected Versions: CoSchool LMS versions n/a through 1.4.3 Description: A deserialization of untrusted data issue exists in CoSchool LMS, allowing for object injection. Recommendations: Update CoSchool LMS to a version later than 1.4.3...

WordPress plugin Hillter 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin KBx Pro Ultimate versions = 8.0.5...

WordPress Visual Art | Gallery WordPress Theme <= 2.4 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Visual Art | Gallery WordPress Theme versions = 2.4...

WordPress SureForms Plugin Multiple Vulnerabilities (Jul 2025)

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:brainstormforce:sureforms"; if description...

WordPress Visual Art | Gallery WordPress Theme Theme <= 2.4 is vulnerable to PHP Object Injection

Software Visual Art | Gallery WordPress Theme Type Theme Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31422 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID f75a5b9fac9b Credits Tran Nguyen Bao Khanh VC...

CVE-2025-7504

The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the queryvars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is prese...

CVE-2025-7504

The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the queryvars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is prese...

CVE-2025-7504 Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection

The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the queryvars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is prese...

CVE-2025-7504

The CVE-2025-7504 affects the WordPress Friends plugin (v3.5.1). It is vulnerable to PHP Object Injection through deserialization of the query_vars parameter. Exploitation requires authenticated access (subscriber level or higher). The vulnerability has no impact unless a POP chain exists in anot...