5473 matches found
CVE-2026-16099 Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...
CVE-2024-13784: Deserialization of Untrusted Data
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...
CVE-2026-10035: Deserialization of Untrusted Data
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...
PT-2026-73103
Name of the Vulnerable Software and Affected Versions Turnkey bbPress by WeaverTheme versions prior to 1.7.2 Description The plugin is susceptible to PHP Object Injection, a condition where untrusted data is passed to the unserialize function, potentially allowing an attacker to manipulate...
PT-2026-73139
Name of the Vulnerable Software and Affected Versions ARForms versions prior to 1.8.6 Description The ARForms plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input received from form submissions. This allows unauthenticated attackers to inject a...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...
WordPress WooCommerce Subscriptions plugin < 9.1.0 - Unauthenticated RCE via PHP Object Injection vulnerability
Unauthenticated RCE via PHP Object Injection vulnerability discovered by Vasily Belolapotkov, Vlad Olaru in WordPress Plugin WooCommerce Subscriptions versions 9.1.0...
...[ More ]
A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...
CVE-2026-28176
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-27380
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28176
CVE-2026-28176 involves the WordPress Booking Activities plugin (
CVE-2026-28176
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
EUVD-2026-57959
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28149
The CVE-2026-28149 entry covers an Unauthenticated PHP Object Injection in the WordPress Headless Single Sign On plugin versions <= 1.6. The underlying issue is a PHP object injection vulnerability that can be exploited without authentication, leading to high impact on confidentiality, integri...