5559 matches found
WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability
Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...
CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...
CVE-2026-0551
PPWP – Password Protect Pages (WordPress plugin) is vulnerable to PHP Object Injection in all versions up to and including 1.9.18 . The flaw stems from deserialization of untrusted input via the post_protection_roles parameter, exploitable by any authenticated user with Contributor-level access o...
CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...
CVE-2026-4703
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...
CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...
EUVD-2026-64521
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...
CVE-2026-4703
WS Form LITE (WordPress plugin) versions up to and including 1.10.80 are vulnerable to unauthenticated PHP Object Injection caused by deserialization of untrusted input from form submission meta values. The plugin itself contains no known POP chain, so the vulnerability has no direct impact unles...
CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...
PT-2026-79589
Name of the Vulnerable Software and Affected Versions WS Form LITE – Drag & Drop Contact Form Builder versions prior to 1.10.81 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This occurs...
CVE-2026-4703: Deserialization of Untrusted Data
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...
PT-2026-79744
Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.19 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the...
forminator-poc-lab
Forminator PoC validation lab This repository packages an iso...
CVE-2026-73993
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-66672
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66583
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...