Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2024-31308

WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Vjinfotech Wordpress
Products
Wp Import Export Lite Wordpress
CVE-2024-25100

WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n/a before 1.8.4.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wpswings
Products
Coupon Referral Program
CVE-2023-52206

WordPress Page Builder: Live Composer Plugin <= 1.5.25 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Blueastral
Products
Page Builder\
CVE-2023-27459

WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wpeverest
Products
User Registration User Registration \& Membership
CVE-2023-23649

WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mainwp
Products
Mainwp Links Manager Extension
CVE-2026-1839

Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers

A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Huggingface
Products
Transformers
CVE-2025-66073

WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60084

WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Add-ons.org Elementor Wordpress
Products
Pdf-for-elementor-forms Elementor Wordpress
CVE-2025-53243

WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory allows Object Injection.This issue affects Employee Directory – Staff Listing & Team Directory Plugin for WordPress: from n/a through <= 4.5.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-52761

WordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager: from n/a through <= 1.4.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-4606

WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes
Products
Utlimate Store Kit Elementor Addons
CVE-2024-35780

WordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Live Composer Team
Products
Page Builder Live Composer
CVE-2024-34433

WordPress One Click Demo Import plugin <=3.2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ocdi
Products
One Click Demo Import
CVE-2024-33641

WordPress Custom field finder plugin <= 0.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-33553

WordPress XStore Core plugin <= 5.3.5 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
8theme
Products
Xstore Core
CVE-2024-32835

WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Import Export Wordpress Users
CVE-2024-32431

WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection

Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpallimport
Products
Wp All Import
CVE-2024-31277

WordPress Product Designer plugin <= 1.0.32 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—