EUVD-2026-57947

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-27380

CVE-2026-27380 affects the WordPress Car Rental Manager plugin

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...

CVE-2026-28149: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

PT-2026-71513

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Headless Single Sign On versions = 1.6...

WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin Car Rental Manager versions = 1.3.9...

CVE-2026-18391

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

CVE-2026-18391

The WooCommerce Subscriptions WordPress plugin (versions prior to 9.1.0 ) is vulnerable to PHP Object Injection when High-Performance Order Storage (HPOS) is enabled. The root cause is the lack of input validation before unserializing data in the WC_Subscriptions_Data_Copier::copy_data() function...

EUVD-2026-57100

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

CVE-2026-18391

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...