CVE-2026-94678: Deserialization of Untrusted Data

Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...

CVE-2026-94677: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

CVE-2026-94121: Deserialization of Untrusted Data

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...

CVE-2026-94076: Deserialization of Untrusted Data

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-94122: Deserialization of Untrusted Data

Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...

CVE-2026-93651: Deserialization of Untrusted Data

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

CVE-2026-97291: Deserialization of Untrusted Data

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-91051: Deserialization of Untrusted Data

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-97256: Deserialization of Untrusted Data

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102377: Deserialization of Untrusted Data

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-100512: Deserialization of Untrusted Data

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Music Player for WooCommerce versions = 1.9.1...

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Conversational Forms for ChatBot versions = 1.5.0...

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Responsive Slider Gallery versions = 1.5.5...

WordPress ConvertPlus plugin <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ConvertPlus versions = 3.6.3...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-87741 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...