CVE-2026-104932

The Search Regex plugin for WordPress (version 3.5 and below) is vulnerable to PHP Object Injection due to the deserialization of untrusted input within the replace_all function. This flaw allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object, which can lead...

EUVD-2026-102679

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...