CVE-2026-87741 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 3.6.3 . The flaw exists in the cp_display_preview_modal AJAX action because the nonce guard fails open when the cp_admin_page_nonce parameter is omitted, and there is no capability check on ...