CVE-2025-22510

CVE-2025-22510 1️⃣ 组件类型 WordPress 插件 2️⃣ 组件详情 组件名称 WC Price History for Omnibus 受影响版本 要激活此插件，必须首先安装并激活 WooCommerce 插件。 2. 要测试 PHP 对象注入漏洞，请将以下 PoCPOPChainObject 类添加到 wp-config.php 文件的末尾。 class PoCPOPChainObject public $message = ""; public function destruct echo "Success PoP Chain"; echo ""; echo...

CVE-2026-97257

The PressTigers Simple Event Planner WordPress plugin is vulnerable to a PHP Object Injection flaw due to the deserialization of untrusted data . This vulnerability affects versions up to and including 1.5.7 . An attacker can leverage this flaw to perform Object Injection , potentially leading to...

CVE-2026-100511 WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1...

CVE-2026-100506 WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1...

CVE-2026-100506 WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1...

CVE-2026-103348

The WP Ultimate Exporter plugin for WordPress (versions

CVE-2026-103348 WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...

CVE-2026-93617 WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-103348 WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...

CVE-2026-104905

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905

FacturaScripts versions prior to 2026.7 are vulnerable to a PHP object injection vulnerability within the WidgetSelect::processFormData() function. The root cause is the application's failure to apply an allowed_classes filter when calling unserialize() on raw POST data for multiple-select fields...

EUVD-2026-92525

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2024-8353-PoC

CVE-2024-8353 的概念验证代码 此仓库包含一个脚本，用于利用WordPress的GiveWP插件中的CVE-2024-8353漏洞。该漏洞允许未经认证的PHP对象注入，可能导致远程代码执行。 概述 提供的脚本演示了该利用： Python脚本 ：自动化识别易受攻击的表单、检索nonce以及传递有效载荷以触发漏洞的过程。 PHP脚本 ：作为精心构造的有效载荷，展示反序列化攻击机制。 漏洞描述...

WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LevinityCyber in WordPress Plugin GDPR Framework By Data443 versions = 2.5.0...

CVE-2026-49104-

CVE-2026-49104- CVE-2026-49104 集成用于 Keap/Infusionsoft PHP 对象注入漏洞利用...

CVE-2026-49105

CVE-2026-49105 CVE-2026-49105 WP Zendesk PHP 对象注入漏洞利用...

PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-

CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE -red 📋 Description CVE-2026-45247 is a critical PHP Object Injection vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce. An unauthenticated attacker can achieve...