CVE-2025-28970

CVE-2025-28970: PHP Object Injection via deserialization in WP Optimize By xTraffic (WordPress plugin). Affected: WP Optimize By xTraffic versions up to and including 5.1.6. Status: Unpatched in the public CVE references. Root cause: Deserialization of untrusted data leading to object injection. ...

CVE-2025-28970 WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimize By xTraffic: from n/a through = 5.1.6...