EUVD-2026-83669

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...

CVE-2026-85017

Unlimited Elements For Elementor WordPress plugin versions below 2.0.20 are affected by a PHP object injection vulnerability (discovered by Jakub Herman). The root cause is a missing capability check on an AJAX action that deserializes attacker-controlled stored data, allowing any authenticated u...

CVE-2024-1813-POC

CVE-2024-1813 - Simple Job Board ≤ 2.11.0 WordPress - Unauthenticated PHP Object Injection 🎥 Proof-of-Concept demo End-to-end: a guest stores a serialized PHP object through the public application form, the admin opens the applicants list, and the gadget chain drops a webshell. Unauthenticated PH...

CVE-2026-9691

CVE-2026-9691 CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

Este tipo de ataque intenta explotar el proceso de deserialización de la aplicación PHP para ejecutar código arbitrario o llevar a cabo acciones no deseadas en el servidor. Estrategias de Mitigación Para defenderse contra la inyección de objetos PHP y ataques similares, considere las siguientes...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Inyección de Objetos PHP no Autenticada Descripción El plugin Lis Video Gallery para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 0.2.1 inclusive, a través de la deserialización de entrada no confiable. Esto permite que...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Inyección de Objetos PHP sin Autenticación Descripción El plugin DS.DownloadList para WordPress es vulnerable a la Inyección de Objetos PHP en todas las versiones hasta la 1.3 inclusive, a través de la deserialización de entrada no confiable. Esto permite qu...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Inyección de Objetos PHP sin Autenticación Descripción El plugin VRPConnector para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 2.0.1 inclusive mediante la deserialización de entrada no confiable. Esto permite que atacantes no...

CVE-2026-65883

CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...

CVE-2026-82226

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-82226 CVE-2026-82226 Tickera 3.6.0.2 — Tickera Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-84753

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-84753 CVE-2026-84753 Mail Mint 1.31.0 — WPFunnels Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

CVE-2026-7654

CVE-2026-7654 CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit...

CVE-2026-49085

CVE-2026-49085 CVE-2026-49085 Exploit de inyección de objetos PHP en WP Insightly...

CVE-2026-93872

Cotonti 1.0.0 is affected by a PHP object injection vulnerability in the comments plugin EditAction . The base64-decoded cb parameter is passed directly to unserialize() without an allowed_classes restriction, allowing registered users with comment write permissions to instantiate arbitrary PHP o...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2024-12877

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...

CVE-2026-17086

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...