CVE-2026-49781: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in OttoKit = 1.1.27 versions...

CVE-2026-49770: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

CVE-2026-49765: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.8 versions...

CVE-2026-49768: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Happyforms = 1.26.13 versions...

CVE-2026-49104: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.2.1 versions...

CVE-2026-49085: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...

CVE-2026-49769: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in wpForo Forum = 3.1.0 versions...

CVE-2026-39499: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Advanced Product Fields Product Addons for WooCommerce = 1.6.19 versions...

CVE-2026-39481: Deserialization of Untrusted Data

Author PHP Object Injection in Modula Image Gallery = 2.14.18 versions...

CVE-2026-39474: Deserialization of Untrusted Data

Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...

CVE-2026-27053: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Broadcast Live Video 7.1.3 versions...

CVE-2026-39472: Deserialization of Untrusted Data

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips 5.9.0 versions...

PT-2026-49399

Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...

CVE-2026-39471: Deserialization of Untrusted Data

Author PHP Object Injection in ShortPixel Image Optimizer = 6.4.3 versions...

CVE-2026-49105: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...

CVE-2026-9691: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 versions...

CVE-2026-39498: Deserialization of Untrusted Data

Shop manager PHP Object Injection in YayMail = 4.3.3 versions...

CVE-2026-49109: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms = 1.4.3 versions...

CVE-2026-49763: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot = 1.3.7 versions...

PT-2026-49343

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.7.13 Description An unauthenticated PHP Object Injection exists in the software. PHP Object Injection occurs when user-supplied input is passed to the PHP unserialize function without proper validation,...