5599 matches found
WordPress String locator plugin < 2.6.8 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin String locator versions 2.6.8...
CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
EUVD-2026-94190
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...
CVE-2026-97188
The String locator WordPress plugin, in versions before 2.6.8 , is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the failure to restrict allowed classes during the deserialization of database row content saved via the plugin's database editor . This allows...
PT-2026-107742
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
CVE-2026-39797
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-104747
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-104747
The Haaken WordPress theme versions
CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
EUVD-2026-93080
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-39797
The WordPress GDPR Framework By Data443 plugin versions
EUVD-2026-93041
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
CVE-2026-39797 WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
Exploit for CVE-2026-104905
CVE-2026-104905 — PHP Object Injection in FacturaScripts Widg...
