CVE-2025-68038

WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Express Pro: from n/a through < 5.9.14.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Icegram Wordpress

Products

Icegram Express Wordpress

CVE-2025-67535

WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Weplugins Wordpress

Products

Wp Maps Wordpress

CVE-2025-53586

WordPress WeMusic Theme <= 1.9.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-33337

Firebird has a buffer overflow when parsing corrupted slice packets

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Firebirdsql

Products

Firebird

CVE-2025-62233

Apache DolphinScheduler: Deserialization of untrusted data in RPC

Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler:  Version >= 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes. Users are recommended to upgrade to version [3.3.1], which fixes the issue.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Dolphinscheduler

CVE-2025-35051

Newforma Project Center Server (NPCS) .NET unauthenticated deserialization

Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Newforma

Products

Project Center Project Center Server

CVE-2026-1323

Insecure Deserialization in extension "Mailqueue" (mailqueue)

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Cps-it Typo3

Products

Mailqueue Extension "mailqueue"

CVE-2025-60080

WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-60081

WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-60082

WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Add-ons.org Wordpress

Products

Pdf For Wpforms Wordpress

CVE-2025-60083

WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Add-ons.org Woocommerce Wordpress

Products

Pdf Invoice Builder For Woocommerce Woocommerce Wordpress

CVE-2025-60089

WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crm Perks Crmperks Wordpress

Products

Wp Gravity Forms Freshdesk Plugin Wp Gravity Forms Freshdesk Plugin Wordpress

CVE-2025-60090

WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crm Perks Crmperks Wordpress

Products

Wp Gravity Forms Insightly Wp Gravity Forms Insightly Wordpress

CVE-2025-60091

WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crm Perks Crmperks Wordpress

Products

Wp Gravity Forms Zoho Crm And Bigin Wp Gravity Forms Zoho Crm And Bigin Wordpress

CVE-2025-60174

WordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crm Perks Crmperks Wordpress

Products

Wp Gravity Forms Constant Contact Plugin Wp Gravity Forms Constant Contact Plugin Wordpress

CVE-2025-60178

WordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Crm Perks Crmperks Wordpress

Products

Wp Gravity Forms Hubspot Wp Gravity Forms Hubspot Wordpress

CVE-2025-64206

WordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Tielabs Wordpress

Products

Jannah Wordpress

CVE-2025-64266

WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Magepeople Wordpress

Products

Booking & Rental Manager Wordpress

CVE-2025-50004

WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Artbees Wordpress

Products

Jupiter X Core Wordpress

CVE-2025-68853

WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kleor Wordpress

Products

Contact Manager Wordpress