5479 matches found
CVE-2026-10749 Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP...
CVE-2026-10749
The Post Duplicator WordPress plugin (versions prior to 3.0.15 ) is vulnerable to PHP Object Injection . The root cause is the unsafe handling of the customMetaData variable during post duplication, where the plugin stores attacker-supplied serialized values without the double-serialization prote...
CVE-2026-10749 Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP...
EUVD-2026-38694
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP...
CVE-2026-10749
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP...
CVE-2026-10749: Undefined Security Weakness
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP...
WordPress Themify Store Locator plugin <= 1.2.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Themify Store Locator versions = 1.2.0...
WordPress Themify Event Post plugin <= 1.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Themify Event Post versions = 1.3.3...
WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Themify Popup versions = 1.4.3...
WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin Uncanny Automator versions = 7.3.1.2...
EUVD-2025-210258
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
EUVD-2026-37607
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
EUVD-2026-37484
Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...
EUVD-2026-37482
Unauthenticated PHP Object Injection in Playroom = 1.4.1 versions...
EUVD-2026-37479
Unauthenticated PHP Object Injection in NeoBeat = 1.7 versions...
EUVD-2026-37480
Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...
EUVD-2026-37462
Contributor PHP Object Injection in Avada = 3.15.3 versions...
EUVD-2025-210191
Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...
