CVE-2023-46154

WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

E2pdf

Products

E2pdf

CVE-2023-46147

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Themify

Products

Ultra

CVE-2023-40555

WordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Uxthemes

Products

Flatsome

CVE-2023-37390

WordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Themesflat

Products

Themesflat Addons For Elementor

CVE-2023-36381

WordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gesundheit-bewegt

Products

Zippy

CVE-2023-34382

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dokan

Products

Dokan

CVE-2023-34027

WordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Rajarora795

Products

Recently Viewed Products

CVE-2023-32795

WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Woocommerce

Products

Product Addons

CVE-2023-32513

WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2023-28782

WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Gravityforms

Products

Gravity Forms

CVE-2022-47599

WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitapps

Products

File Manager

CVE-2022-45845

WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextendweb

Products

Smart Slider 3

CVE-2022-45083

WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Properfraction

Products

Profilepress

CVE-2022-33900

WordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Awesomemotive

Products

Easy Digital Downloads

CVE-2026-41316

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed

Vendors

Ruby

Products

Erb

CVE-2026-34615

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more

CVE-2026-27303

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more

CVE-2025-49386

WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-49380

WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress Wpinstinct

Products

Woocommerce Wordpress Woocommerce Vehicle Parts Finder

CVE-2025-48086

WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp-dreams

Products

Wordpress Ajax Search