CVE-2025-0855

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'importheader' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in...

CVE-2025-0855 PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'importheader' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in...

CVE-2025-0855

CVE-2025-0855 affects the WordPress PGS Core plugin up to and including v5.8.0, enabling unauthenticated PHP Object Injection via deserialization in import_header. Impact ranges from arbitrary file deletion and data exposure to potential code execution if a POP chain exists with another plugin/th...

CVE-2025-0855 PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'importheader' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in...

PT-2025-19871 · WordPress · Pgs Core

Name of the Vulnerable Software and Affected Versions: PGS Core plugin for WordPress versions up to, and including, 5.8.0 Description: The issue concerns PHP Object Injection via deserialization of untrusted input in the import header function, allowing unauthenticated attackers to inject a PHP...

CVE-2025-0855: Deserialization of Untrusted Data

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'importheader' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in...

WordPress plugin PGS Core code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by stealthcopter in WordPress Plugin Captivate Sync versions = 3.0.3...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2105 Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2105

CVE-2025-2105 (Jupiter X Core) affects WordPress Jupiter X Core plugin up to version 4.8.11. Vulnerability: PHP Object Injection via deserialization of untrusted input from the ‘file’ parameter of raven_download_file, enabling injection of a PHP object through a PHAR file. Impact is contingent on...

CVE-2025-2105 Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

PT-2025-17948 · WordPress · Jupiter X Core

Name of the Vulnerable Software and Affected Versions: Jupiter X Core plugin for WordPress versions up to, and including, 4.8.11 Description: The issue allows for PHP Object Injection via deserialization of untrusted input from the file parameter of the raven download file function, making it...

CVE-2025-2105: Deserialization of Untrusted Data

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

WordPress plugin Jupiter X Core code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress Jupiter X Core plugin <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR vulnerability

Unauthenticated PHP Object Injection via PHAR vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin JupiterX Core versions = 4.8.11...

WordPress Social Counter plugin <= 2.0.5 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Social Counter versions = 2.0.5...

WordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Ngo Bui Truong Vu in WordPress Plugin Flickr Shortcode Importer versions = 2.2.3...