5656 matches found
PT-2026-71525
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
PT-2026-71497
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-28176: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28149: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-27380: Deserialization of Untrusted Data
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Headless Single Sign On versions = 1.6...
WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin Car Rental Manager versions = 1.3.9...
CVE-2026-18391
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
EUVD-2026-57100
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
CVE-2026-18391
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
CVE-2026-18391
The WooCommerce Subscriptions WordPress plugin (versions prior to 9.1.0 ) is vulnerable to PHP Object Injection when High-Performance Order Storage (HPOS) is enabled. The root cause is the lack of input validation before unserializing data in the WC_Subscriptions_Data_Copier::copy_data() function...
WordPress 69: PHP Object Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress 69 Clothing has a PHP object injection vulnerability, which stems from the lack of security checks on deserialized data by the program. Attackers can exploit this vulnerability to...
WordPress: A Williams PHP Object Injection Vulnerability
WordPress A Williams is a commercial WordPress theme designed for secretaries, personal assistants, administrative staff, and consulting companies. WordPress A Williams has a PHP object injection vulnerability, which stems from improper deserialization of untrusted data, allowing for PHP object...
WordPress AI ANN PHP Object Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...
CVE-2026-18391: Unrestricted Upload of File with Dangerous Type
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...
WordPress Ajax Search Lite PHP Object Injection Vulnerability
WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...
PT-2026-71025
Name of the Vulnerable Software and Affected Versions WooCommerce Subscriptions versions prior to 9.1.0 Description Insufficient validation of user input before unserialization occurs on stores with High-Performance Order Storage enabled. This leads to a PHP Object Injection, which unauthenticate...