Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,823

Export CSV
CVE-2024-49684

WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Revmakx
Products
Backup And Staging By Wp Time Capsule
CVE-2024-49624

WordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Smartdevth
Products
Advanced Advertising System
CVE-2024-49332

WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Giveaway Boost Giveawayboost
Products
Giveaway Boost Giveaway Boost
CVE-2024-49318

WordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: from n/a through <= 1.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Olsonsp4c
Products
My Reading Library
CVE-2024-49222

WordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-48033

WordPress Talkback plugin <= 1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through <= 1.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Talkback
Products
Talkback
CVE-2024-48030

WordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Gabriele Valenti
Products
Telecash Ricaricaweb
CVE-2024-48028

WordPress IP Loc8 plugin <= 1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Boyan Raichev
Products
Ip Loc8
CVE-2024-48026

WordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Grayson Robbins
Products
Disc Golf Manager
CVE-2024-47636

WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-44000

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

CVSS 3.1 · 9.8 Critical EPSS 82.3% KEV · Not listed
Vendors
Litespeedtech
Products
Litespeed Cache
CVE-2024-43252

WordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Crewhrm
Products
Crewhrm
CVE-2024-37930

WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMag: from n/a through < 10.1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Theme-sphere Themesphere
Products
Smartmag Smartmag
CVE-2024-32817

WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.2.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-30229

WordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Givewp Wordpress
Products
Givewp Wordpress
CVE-2024-30221

WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sunshinephotocart
Products
Sunshine Photo Cart
CVE-2024-29136

WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Themefic
Products
Tourfic
CVE-2026-35464

pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution

pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. The storage_folder option is not in this set and passes the existing path restriction because the Flask session directory is outside both PKGDIR and userdir. A user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store, plant a malicious pickle payload as a predictable session file, and trigger arbitrary code execution when any HTTP request arrives with the corresponding session cookie. This vulnerability is fixed with commit c4cf995a2803bdbe388addfc2b0f323277efc0e1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pyload
Products
Pyload
CVE-2025-53242

WordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress