CVE-2026-65573: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Abelle = 1.22 versions...

CVE-2026-65572: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...

CVE-2026-65556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

CVE-2026-65552: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-65549: Deserialization of Untrusted Data

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

PT-2026-68564

Name of the Vulnerable Software and Affected Versions Accalia versions prior to 1.5.4 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...

CVE-2026-65575: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...

PT-2026-68563

Name of the Vulnerable Software and Affected Versions Abogado versions prior to 1.19 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain a sequence of gadgets used t...

PT-2026-68567

Name of the Vulnerable Software and Affected Versions Agora versions prior to 2.0 Description The Agora Event & Conference WordPress Theme is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no P...

PT-2026-68569

Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...

CVE-2026-65576: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...

CVE-2026-28139: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

PT-2026-68568

Name of the Vulnerable Software and Affected Versions Agricola versions prior to 1.22.0 Description The Agricola - Agriculture & Organic Farm Theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection...

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPBruiser no- Captcha anti-Spam versions = 3.1.43...

PT-2026-68554

Name of the Vulnerable Software and Affected Versions WPBruiser no- Captcha anti-Spam versions prior to 3.1.44 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to manipulate the resulting object. Thi...

PT-2026-68166

Name of the Vulnerable Software and Affected Versions Cotonti CMS affected versions not specified Description The Comments plugin in Cotonti CMS fails to restrict classes during the deserialization of user-supplied data, leading to a PHP Object Injection. This occurs when the unserialize function...

EUVD-2026-52894

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...