WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Content Egg versions = 6.3.1...

WordPress Online Scheduling and Appointment Booking System plugin 23.2-28.2 - Bookly Administrator+ PHP Object Injection vulnerability

Bookly Administrator+ PHP Object Injection vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Bookly versions 23.2-28.2...

CVE-2026-86841 Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

EUVD-2026-87891

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86841 Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86841

The Online Scheduling and Appointment Booking System (Bookly) WordPress plugin, versions 23.2 through 28.2 , is vulnerable to a PHP Object Injection vulnerability. The root cause is the failure to prevent the deserialization of untrusted input and the improper restriction of a privileged maintena...

WordPress wpForo Forum plugin < 3.1.6 - Subscriber+ PHP Object Injection vulnerability

Subscriber+ PHP Object Injection vulnerability discovered by Sai Praneeth Koti in WordPress Plugin wpForo Forum versions 3.1.6...

CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

CVE-2026-96745

The MongoDB PHP Driver is vulnerable to an unauthenticated deserialization attack within its command monitoring support. When an application registers a command monitoring subscriber and processes untrusted data in a database operation, an attacker can cause the driver to honor class names embedd...

CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.2.5...

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.51...

WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kadence WooCommerce Email Designer versions = 1.5.19.1...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.33.6...

WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Go Live Update Urls versions = 7.0.8...

CVE-2026-80513

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

EUVD-2026-85796

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...