PT-2026-127873

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

PT-2026-132242

Name of the Vulnerable Software and Affected Versions Zippy versions prior to 1.7.1 Description An issue exists due to the deserialization of untrusted input, allowing authenticated attackers with editor-level access and above to inject a PHP Object. While no POP chain a sequence of gadgets used ...

PT-2026-132244

Name of the Vulnerable Software and Affected Versions Dynamic QR Code – generator versions prior to 1.0.2 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the application...

PT-2026-132249

Name of the Vulnerable Software and Affected Versions WP Media folders versions prior to 1.1.11 Description Authenticated attackers with contributor-level access and above can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used...

PT-2026-132248

Name of the Vulnerable Software and Affected Versions Finale Lite versions prior to 2.21.1 Description The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress allows authenticated attackers with shop manager-level access and above to perform PHP Object Injection...

PT-2026-132251

Name of the Vulnerable Software and Affected Versions Sastra Essential Addons for Elementor versions prior to 1.2.4 Description The software is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing authenticated users with author-level access or higher t...

PT-2026-132243

Name of the Vulnerable Software and Affected Versions Extra Fees Plugin for WooCommerce versions prior to 4.4.1 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the...

PT-2026-129208

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

CVE-2026-103688: Unknown Checkout Files Upload for WooCommerce: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

WordPress Rank Math SEO deserialization injection vulnerability

WordPress Rank Math SEO versions 1.0.276 and earlier contain a deserialization injection vulnerability. This vulnerability arises because the updateMeta REST API endpoint deserializes untrusted input, leading to PHP object injection. It can be exploited via a POP chain to write a webshell into th...

CVE-2026-61564: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

PHP 8.5.11 PHP2Shell Detection / Mitigation

An Ansible role and Python tool detect PHP versions affected by the php2shell vulnerabilities across installed runtimes and optionally upgrade distribution packages and restart affected services...

OpenCATS input validation error vulnerability

Versions prior to OpenCATS 0.10.0 contain a security vulnerability. This vulnerability arises because the manageProfessional function in SettingsUI fails to properly escape input from administrators; it instead reuses the license key input as a PHP define statement within config.php. This may lea...

PT-2026-132241

Name of the Vulnerable Software and Affected Versions WPCargo Track & Trace versions prior to 8.0.6 Description The WPCargo Track & Trace plugin for WordPress allows authenticated attackers with author-level access and above to perform PHP Object Injection. This occurs due to the deserialization ...

CVE-2026-58256

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...

CVE-2026-58256

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as "ldapfilter", poisoning "/personnalisation/configldap.inc.php" and permitting remote code...

CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...

CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...

CVE-2026-58256

The resource management and reservation application GRR is vulnerable to Remote Code Execution (RCE) via PHP code injection in versions prior to 4.5.0 . An administrator can inject malicious PHP by using LDAP connector configuration parameters, such as ldap_filter, to poison the /personnalisation...

EUVD-2026-111409

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...