5591 matches found
PT-2026-107767
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...
WordPress Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion vulnerability
Authenticated Subscriber+ PHP Object Injection to Arbitrary File Deletion vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Uncanny Automator versions = 7.6.1.1...
CVE-2026-95534 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...
CVE-2026-95534
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting versions up to and including 2.0.19 , is vulnerable to a PHP Object Injection flaw. This issue stems from the deserialization of untrusted data , which could allow an attacker to execute arbitrary c...
DRUPAL-CONTRIB-2026-192
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme ColorFolio versions = 1.3...
WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Neo | Barber Shop WordPress Theme versions = 3.5...
WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme CleanSkin versions = 1.5.0...
WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
WordPress Payever - WooCommerce Gateway plugin = 4.8.2 - PHP Object Injection vulnerability discovered by Lee chul woong in WordPress Plugin Payever - WooCommerce Gateway versions = 4.8.2...
WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Dynamic User Directory versions = 2.4...
WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Quiz And Survey Master versions = 11.2.7...
WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Configurator for WooCommerce versions = 1.7.5...
WordPress String locator plugin < 2.6.8 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin String locator versions 2.6.8...
CVE-2026-97188
The String locator WordPress plugin, in versions before 2.6.8 , is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the failure to restrict allowed classes during the deserialization of database row content saved via the plugin's database editor . This allows...
CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
EUVD-2026-94190
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
PT-2026-107742
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
