5469 matches found
WordPress: A Williams PHP Object Injection Vulnerability
WordPress A Williams is a commercial WordPress theme designed for secretaries, personal assistants, administrative staff, and consulting companies. WordPress A Williams has a PHP object injection vulnerability, which stems from improper deserialization of untrusted data, allowing for PHP object...
CVE-2026-18391: Unrestricted Upload of File with Dangerous Type
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...
WordPress Grand Car Rental theme <= 3.7.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Car Rental versions = 3.7.2...
CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
PT-2026-69168
Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.16 Description An issue exists where the software fails to restrict the classes allowed during the unserialization of values received from public form submissions. This allows unauthenticated...
CVE-2026-16258
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-16258
The Ajax Search Lite WordPress plugin (versions before 4.14.5 ) is vulnerable to PHP Object Injection due to the insecure deserialization of untrusted input. This flaw is specifically located in the Search Statistics REST Endpoint . An unauthenticated attacker can exploit this to achieve Remote C...
EUVD-2026-54389
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
PT-2026-68870
Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description An issue exists where the software fails to prevent the deserialization of untrusted input, enabling unauthenticated attackers to perform PHP Object Injection. This occurs via the Search...
CVE-2026-16258: Deserialization of Untrusted Data
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-65581
The CVE-�2026-65581 entry concerns the WordPress AI ANN theme (<= 1.29.0) and describes an unauthenticated PHP Object Injection vulnerability. The connected documents corroborate the affected product and version range, with a focus on PHP object injection as the underlying issue. There are no ...
CVE-2026-65579
CVE-2026-65579 describes an unauthenticated PHP Object Injection in the WordPress Agricola theme up to version 1.21.0. The affected component is the Agricola WordPress theme; the root cause is a PHP object injection vulnerability, enabling an attacker to achieve total compromise without authentic...
EUVD-2026-53878
Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...