EUVD-2026-48197

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

CVE-2026-65493: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65497: Deserialization of Untrusted Data

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-59544: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

WordPress Complianz plugin <= 7.5.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Complianz versions = 7.5.1...

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin Thrive Quiz Builder versions = 10.9.3.0...

CVE-2026-12987 Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-12987: Improper Neutralization of Special Elements used in an SQL Command

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159

CVE-2026-54159 affects PrestaShop ps_facetedsearch module versions 3.0.0 through 4.0.3. The root cause is trusting the value of slider filters (price/weight) from the request URL, storing it in an internal cache, and deserializing it with PHP’s native unserialize(), enabling a crafted object inje...

CVE-2026-54159: Improper Neutralization of Special Elements in Output Used by a Downstream Component

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-15008

The CVE concerns The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress. All versions up to and including 7.3.1.4 are affected by an arbitrary file deletion vulnerability caused by insufficient file path validation in the fr_token function, enabling...

CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

Exploit for CVE-2026-48909

CVE-2026-48909-Joomla-SP-Exploit CVE-2026-48909 - Unauthentica...

CVE-2026-12583

The Newsletters WordPress plugin, versions prior to 4.15 , is vulnerable to a PHP object injection flaw. The issue stems from the failure to prevent the deserialization of untrusted input submitted through a public form. An unauthenticated attacker can exploit this by injecting a PHP object and l...

CVE-2026-12583: Deserialization of Untrusted Data

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, wri...

EUVD-2026-43286

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator...