CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

PT-2026-103158

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

PT-2026-103185

Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...

PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

PT-2026-103504

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

PT-2026-103039

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102377: Deserialization of Untrusted Data

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-91051: Deserialization of Untrusted Data

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-97246: Deserialization of Untrusted Data

Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...

PT-2026-103217

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

PT-2026-103189

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

PT-2026-103170

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...

CVE-2026-100512: Deserialization of Untrusted Data

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

PT-2026-103161

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Music Player for WooCommerce versions = 1.9.1...

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Conversational Forms for ChatBot versions = 1.5.0...

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Responsive Slider Gallery versions = 1.5.5...