CVE-2026-85017 Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...

EUVD-2026-83669

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...

CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20 ) is vulnerable to PHP Object Injection . The root cause is a missing capability check on an AJAX action , which allows the plugin to deserialize attacker-controlled stored data. This flaw enables authenticated attacker...

PT-2026-95922

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor versions prior to 2.0.20 Description The plugin fails to perform a capability check on an AJAX action and deserializes stored data controlled by an attacker. This allows authenticated users with subscriber-leve...

CVE-2026-85017: Deserialization of Untrusted Data

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...

CVE-2026-93872

Cotonti 1.0.0 is affected by a PHP object injection vulnerability in the comments plugin EditAction . The base64-decoded cb parameter is passed directly to unserialize() without an allowed_classes restriction, allowing registered users with comment write permissions to instantiate arbitrary PHP o...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

Exploit for CVE-2026-82226

abraxaslabs.tech · github.com/abraxas ·&...

Exploit for CVE-2026-84753

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-17086

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086

The ShortPixel Image Optimizer WordPress plugin (versions

EUVD-2026-82653

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

PT-2026-95228

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6 Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with...

CVE-2026-17086: Deserialization of Untrusted Data

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS

On August 23rd, 2026, Wordfence Argus, our AI research agent specializing in complex vulnerability chains, discovered a PHP Object Injection vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites. This vulnerability allows any authenticated attacker with...

WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability

Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...