CVE-2025-68853

WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kleor Wordpress

Products

Contact Manager Wordpress

CVE-2026-22471

WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Maximsecudeal Wordpress

Products

Secudeal Payments For Ecommerce Wordpress

CVE-2026-34078

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

CVSS 4.0 · 9.3 Critical EPSS 1.7% KEV · Not listed

Vendors

Flatpak

Products

Flatpak

CVE-2026-22384

WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Leafcolor Wordpress

Products

Applay - Shortcodes Wordpress

CVE-2026-4900

code-projects Online Food Ordering System localhost.sql privilege escalation

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Online Food Ordering System

CVE-2026-3328

Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Shabti Wordpress

Products

Frontend Admin By Dynamapps Wordpress

CVE-2026-4860

648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

648540858

Products

Wvp-gb28181-pro

CVE-2026-32502

WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Borgholm Wordpress

CVE-2026-27082

WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Love Story Wordpress

CVE-2026-27045

WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Sbthemes Wordpress

Products

Woocommerce Infinite Scroll Wordpress

CVE-2026-32512

WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Pelicula Wordpress

CVE-2026-32513

WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Miguel Useche Wordpress

Products

Js Archive List Wordpress

CVE-2026-25429

WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdive

Products

Wordpress Nexa Blocks

CVE-2026-25400

WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Thememount Wordpress

Products

Apicona Wordpress

CVE-2026-27095

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mage-people Wordpress

Products

Bus Ticket Booking With Seat Reservation Wordpress

CVE-2026-27084

WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Buisson Wordpress

CVE-2026-27083

WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Work & Travel Company Wordpress

CVE-2026-25359

WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rascals Wordpress

Products

Pendulum Wordpress

CVE-2026-23971

WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2026-22510

WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Melody Wordpress