CVE-2026-62013

WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62008

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62002

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54859

WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118081

WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116868

WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-87692

Microsoft Exchange Server Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 5 more

CVE-2026-62017

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62012

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62006

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62001

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54858

WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116867

WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116098

SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization

A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Steelraven7

Products

Ravenfield

CVE-2026-114724

roundcubemail: roundcubemail: Arbitrary code execution via session object injection

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Roundcube

Products

Webmail

CVE-2026-116392

WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116391

WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116390

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters: from n/a through 1.9.7.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116389

WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-115590

WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—