113775 matches found
WordPress FV Flowplayer Video Player deserialization injection vulnerability
WordPress FV Flowplayer Video Player versions 8.3.4 and earlier contain a deserialization injection vulnerability. This vulnerability stems from PHP object injection in the Shop Manager component...
WordPress myPOS Checkout deserialization injection vulnerability
WordPress myPOS Checkout versions 1.4.5 and earlier contain a deserialization injection vulnerability. This vulnerability stems from PHP object injection in the store administrator functionality, potentially enabling PHP object injection attacks...
WordPress News Kit Addons For Elementor deserialization injection vulnerability
WordPress News Kit Addons For Elementor versions 1.5.0 and earlier contain a deserialization injection vulnerability. This vulnerability stems from PHP object injection in subscribers...
WordPress YayMail deserialization injection vulnerability
WordPress YayMail versions 4.4.6 and earlier contain a deserialization injection vulnerability. This vulnerability stems from PHP object injection in the Shop Manager...
CVE-2026-80069: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any…
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...
CVE-2026-54858: ThemeREX Printy: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
Unauthenticated PHP Object Injection in Printy = 1.13.0 versions...
CVE-2026-54857: ThemeREX Quirky: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
Unauthenticated PHP Object Injection in Quirky = 1.23 versions...
CVE-2026-61997: ThemeREX Legal Stone: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
Unauthenticated PHP Object Injection in Legal Stone = 1.2.11 versions...
CVE-2026-62002: ThemeREX Meals & Wheels: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
Unauthenticated PHP Object Injection in Meals & Wheels = 1.1.13 versions...
CVE-2026-62001: ThemeREX Marcell: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
Unauthenticated PHP Object Injection in Marcell = 1.2.14 versions...
CVE-2026-62005: ThemeREX Muzicon: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
Unauthenticated PHP Object Injection in Muzicon = 1.15 versions...
CVE-2026-62010: ThemeREX Avventure: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
Unauthenticated PHP Object Injection in Avventure = 1.1.12 versions...
CVE-2026-61992: Von Eyal Fitoussi GEO my WordPress: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Unauthenticated PHP Object Injection in GEO my WordPress = 4.5.5.3 versions...
CVE-2026-118080: Social Snap: Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.
Contributor PHP Object Injection in Social Snap = 1.5.4 versions...
CVE-2026-116865: Gesundheit Bewegt GmbH Zippy: Editor PHP Object Injection in Zippy <= 1.7.0 versions.
Editor PHP Object Injection in Zippy = 1.7.0 versions...
CVE-2026-116866: Dotstore Extra Fees Plugin for WooCommerce: Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce = 4.4.0 versions...
CVE-2026-118075: dbarrere WP Media folders: Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...
CVE-2026-118073: blazethemes News Kit Elementor Addons: Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
Subscriber PHP Object Injection in News Kit Elementor Addons = 1.5.0 versions...
ThemeREX Legal Stone deserialization injection vulnerability
ThemeREX Legal Stone versions 1.2.11 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unauthenticated PHP object injection, which may lead to arbitrary code execution...
ICTBroadcast PHP-CGI/PHP-FPM cross-site scripting vulnerability
The ICTBroadcast PHP-CGI/PHP-FPM version contains a cross-site scripting vulnerability. This flaw arises because the editFormextensionusername parameter in the login.php endpoint is reflected without proper filtering, making it susceptible to cross-site scripting attacks. Such attacks could allow...