WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...

EUVD-2026-64809

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-66650

CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the WordPress theme FreightCo , affecting versions ≤ 1.1.15 . Discovered by daroo , it allows a remote, unauthenticated attacker to achieve full compromise (confidentiality, integrity, and availability), rated CVSS 9.8 (CR...

CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-40877: Deserialization of Untrusted Data

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...

PT-2026-81052

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions 2.0.63 and earlier Description PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the resulting object and potentially...

CVE-2026-66650: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-32563: Deserialization of Untrusted Data

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

PT-2026-80997

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. The user preference functionality is susceptible to PHP object injection, a condition where untrusted input is passed to the PHP unseriali...

PT-2026-81058

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to...

CVE-2026-78265: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78262: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

PT-2026-81055

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551: Deserialization of Untrusted Data

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...

CVE-2026-0551

PPWP – Password Protect Pages (WordPress plugin) is vulnerable to PHP Object Injection in all versions up to and including 1.9.18 . The flaw stems from deserialization of untrusted input via the post_protection_roles parameter, exploitable by any authenticated user with Contributor-level access o...