CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

Exploit for CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0...

CVE-2026-82226: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

Exploit for CVE-2026-82222

CVE-2026-82222 Unauthenticated PHP object injection to RCE...

CVE-2026-76547

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547

The User Profile Builder WordPress plugin (versions before 4.0.1 ) is vulnerable to PHP Object Injection due to a lack of data type validation during configuration file imports. The vulnerability exists within a free add-on feature that is disabled by default; however, an Administrator (or Networ...

WordPress User Profile Builder plugin < 4.0.1 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by Vivien LEBAS in WordPress Plugin Profile Builder versions 4.0.1...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

EUVD-2026-68051

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547: Deserialization of Untrusted Data

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

PT-2026-83403

Name of the Vulnerable Software and Affected Versions User Profile Builder WordPress plugin versions prior to 4.0.1 Description Insufficient validation of deserialized data occurs when importing a configuration file, which allows high privilege users, such as administrators, to perform PHP Object...

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

GHSA-W23P-WRP7-CH38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

EUVD-2026-67870

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ionut Pipirig in WordPress Plugin Tickera versions = 3.6.0.2...

WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability

Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...

EUVD-2026-67567

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...