110120 matches found
CVE-2026-91051: Deserialization of Untrusted Data
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
PT-2026-103039
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-93624: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
CVE-2026-97291: Deserialization of Untrusted Data
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
CVE-2026-102392: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
PT-2026-103328
Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...
PT-2026-103215
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
CVE-2026-96831: Deserialization of Untrusted Data
Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...
PT-2026-103631
Name of the Vulnerable Software and Affected Versions simple-php-router versions prior to 5.4.1.8 Description The IpRestrictAccess middleware contains a flaw that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. By spoofing the X-Forwarded-For,...
CVE-2026-94122: Deserialization of Untrusted Data
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...
CVE-2026-97256: Deserialization of Untrusted Data
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
CVE-2026-94678: Deserialization of Untrusted Data
Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...
CVE-2026-94121: Deserialization of Untrusted Data
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
CVE-2026-94076: Deserialization of Untrusted Data
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...
CVE-2026-93771: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...
PT-2026-103504
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
PT-2026-103184
Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...
CVE-2026-94683: Deserialization of Untrusted Data
Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...