CVE-2026-118090: Stylemix MasterStudy LMS: Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...

CVE-2026-39738: Aman FunnelKit Automations: Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object…

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1...

PT-2026-133606

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/import csv.php call PHP's native unserialize on user career.extra data retrieved from the database without the allowed classes: false safety option. An attacker able t...

PT-2026-133766

Name of the Vulnerable Software and Affected Versions MasterStudy LMS versions prior to 3.7.56 Description An issue exists that allows for PHP Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...

PT-2026-133745

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

PT-2026-133603

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTML QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms...

CVE-2026-90888: LeadSnap: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

Unauthenticated PHP Object Injection in LeadSnap = 1.25 versions...

CVE-2026-118089: RexTheme Product Feed Manager: Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...

CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-103039: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,…

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::createpost passing the submitted value to WordPress' unrestricted global maybeunserialize rather...

CVE-2026-78527: GS Plugins GS Testimonial Slider: Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

Contributor PHP Object Injection in GS Testimonial Slider = 3.3.10 versions...

PT-2026-134442

Name of the Vulnerable Software and Affected Versions PDF Invoice for WooCommerce + Drag and Drop Template Builder versions prior to 7.1.2 Description PHP Object Injection occurs due to insufficient sanitization of the customer note parameter. The input is inlined into invoice HTML, entity-decode...

CVE-2026-73186: ShortPixel Enable Media Replace: Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

PT-2026-133793

Name of the Vulnerable Software and Affected Versions LeadSnap versions 1.25 and earlier Description An unauthenticated attacker can perform a PHP Object Injection by sending crafted input to the lead plugin. This occurs when the application unserializes untrusted data, which can lead to the...

AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts to an...

PT-2026-133792

Name of the Vulnerable Software and Affected Versions GS Testimonial Slider versions prior to 3.3.11 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with contributor-level access or higher can inject a PHP Object. Whil...

PT-2026-133765

Name of the Vulnerable Software and Affected Versions Product Feed Manager versions 7.14.1 and earlier Description Shop manager is subject to PHP Object Injection, a condition where untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to manipulate objects a...

CVE-2026-62121: Unlimited Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

PT-2026-133791

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-44344: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...