4338 matches found
CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
CVE-2026-18391
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
WordPress: A Williams PHP Object Injection Vulnerability
WordPress A Williams is a commercial WordPress theme designed for secretaries, personal assistants, administrative staff, and consulting companies. WordPress A Williams has a PHP object injection vulnerability, which stems from improper deserialization of untrusted data, allowing for PHP object...
WordPress Ajax Search Lite PHP Object Injection Vulnerability
WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...
WordPress AI ANN PHP Object Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...
PT-2026-71025
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
WordPress 69: PHP Object Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress 69 Clothing has a PHP object injection vulnerability, which stems from the lack of security checks on deserialized data by the program. Attackers can exploit this vulnerability to...
WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...
WordPress Grand Car Rental theme <= 3.7.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Car Rental versions = 3.7.2...
CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
PT-2026-69168
Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.16 Description An issue exists where the software fails to restrict the classes allowed during the unserialization of values received from public form submissions. This allows unauthenticated...
CVE-2026-16258
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-16258
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
EUVD-2026-54389
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-65581
The CVE-�2026-65581 entry concerns the WordPress AI ANN theme (<= 1.29.0) and describes an unauthenticated PHP Object Injection vulnerability. The connected documents corroborate the affected product and version range, with a focus on PHP object injection as the underlying issue. There are no ...