5225 matches found
CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-14558
The User Frontend WordPress plugin, in versions before 4.3.10 , is vulnerable to a PHP Object Injection flaw. The root cause is the failure to properly validate field type definitions, leading to the deserialization of user-controlled post metadata during the rendering of submitted posts. This vu...
PT-2026-82873
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
PT-2026-84027
Name of the Vulnerable Software and Affected Versions Tickera versions prior to 3.6.0.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects a...
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292
CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions
EUVD-2026-66946
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78286
CVE-2026-78286 affects the WordPress Geo Controller plugin in versions ≤ 8.9.8 . The vulnerability is an unauthenticated PHP Object Injection , meaning an attacker can trigger it over the network without any credentials or user interaction. The CNA (Patchstack) assigned a CVSS 3.1 score of 9.8 (C...
CVE-2026-78286 WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
EUVD-2026-66939
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276
CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78257
CVE-2026-78257 is a PHP Object Injection vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce (versions ≤ 2.7.5), discovered by daroo and rated CVSS 8.8 (High) by Patchstack. The flaw allows a user with Contributor privilege to exploit the injection over the network wi...