CVE-2026-39577

Unauthenticated PHP Object Injection in Playroom = 1.4.1 versions...

CVE-2026-39573

Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...

CVE-2026-39567

Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...

CVE-2026-39554

Unauthenticated PHP Object Injection in Fidalgo = 1.2.2 versions...

CVE-2026-39446

Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...

CVE-2026-39443

Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...

CVE-2025-69108

Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...

EUVD-2026-37698

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

EUVD-2026-37694

Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...

CVE-2026-39560 WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...

CVE-2026-39576 WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...

CVE-2026-39556 WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Konsept = 1.9 versions...

CVE-2025-69111 WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...

CVE-2026-54806 WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...

CVE-2026-52706 WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...

CVE-2026-52706

CVE-2026-52706 : Unauthenticated PHP Object Injection in WordPress JetEngine plugin (versions ≤ 3.8.10). Affected component: JetEngine; vulnerability type: PHP Object Injection. Impact: high confidentiality, integrity, and availability (CVSS 3.1 base score 9.8; network attack vector; no user inte...

CVE-2026-49107 WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...

CVE-2026-49075 WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...

CVE-2026-42380

CVE-2026-42380 covers the WordPress AI Lab theme prior to version 5.4.2, which is vulnerable to unauthenticated PHP Object Injection. The Patchstack entry and CVE records indicate the vulnerability is fixed in 5.4.2. Impact is high (remote, unauthenticated) per the CVSS vector: Network, None priv...

CVE-2026-40735 WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Reina = 2.1 versions...