WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Jeg Kit for Elementor versions = 3.2.10...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962

CVE-2026-15962 affects the Fluent Forms Pro Add On Pack for WordPress (all versions up to 6.2.6). It enables PHP Object Injection through deserialization of untrusted input. An authenticated attacker with Subscriber-level access or higher can inject a PHP Object, with a POP chain allowing passwor...

EUVD-2026-49047

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

EUVD-2026-48108

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-65497

CVE-2026-65497 concerns the WordPress Complianz plugin, affected in versions ≤ 7.5.0, with a PHP Object Injection vulnerability identifiable under the described Administrator context. The root cause is a PHP object injection flaw within Complianz that could be exploited via a network attack vecto...

CVE-2026-65493

The CVE-2026-65493 entry concerns the WordPress Dokan Pro plugin (

EUVD-2026-48104

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-59544

The CVE covers WordPress Thrive Quiz Builder plugin versions

EUVD-2026-48197

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

CVE-2026-12987

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-12987 Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-12987

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-12987

The CVE covers the WordPress plugin Events Manager (before 7.3.7). It describes that in No-User-Account Booking Mode, a booking-field supplied by the booker is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. This object-injection c...

EUVD-2026-47613

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159

CVE-2026-54159 affects PrestaShop ps_facetedsearch module versions 3.0.0 through 4.0.3. The root cause is trusting the value of slider filters (price/weight) from the request URL, storing it in an internal cache, and deserializing it with PHP’s native unserialize(), enabling a crafted object inje...

CVE-2026-45162

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, multiple Pimcore locations call PHP's unserialize on data from database columns and filesystem files without the allowedclasses restriction, including lib/Tool/Authentication.php, models/Site/Dao.php...