WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Go Live Update Urls versions = 7.0.8...

CVE-2026-80513

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

EUVD-2026-85796

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80513

The wpForo Forum WordPress plugin versions prior to 3.1.6 is vulnerable to PHP Object Injection . The root cause is a failure to restrict which classes may be instantiated during the deserialization of a user-supplied profile field value. This allows authenticated users with Subscriber-level acce...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80513: Deserialization of Untrusted Data

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-95603

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603

The Reycob Product Import Export plugin for WordPress, specifically versions

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

EUVD-2026-85506

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Reycob Product Import Export versions = 2.3.0...

WordPress Ninja Forms plugin 3.15.3 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Ninja Forms versions 3.15.3...

PT-2026-97491

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-43642

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-43642 Softaculous Virtualizor PHP Object Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

EUVD-2026-84622

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...