Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2025-27300

WordPress ADFO plugin <= 1.9.1 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-27287

WordPress SS Quiz Plugin <= 2.0.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ssvadim SS Quiz ssquiz allows Object Injection.This issue affects SS Quiz: from n/a through <= 2.0.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-27286

WordPress Saoshyant Slider Plugin <= 3.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in saoshyant1994 Saoshyant Slider saoshyant-slider allows Object Injection.This issue affects Saoshyant Slider: from n/a through <= 3.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-26999

WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2025-26967

WordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wpgeodirectory
Products
Events Calendar*
CVE-2025-26921

WordPress Booking and Rental Manager Plugin <= 2.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-26900

WordPress Flexmls® IDX Plugin Plugin <= 3.14.27 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-26873

WordPress Traveler theme <= 3.1.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-26763

WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Plugin <= 3.94.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-24779

WordPress Yogi theme < 2.9.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-24671

WordPress Save as PDF Plugin by Pdfcrowd Plugin <= 4.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through <= 4.4.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-24661

WordPress Taxi Booking Manager for WooCommerce plugin <= 1.1.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-24601

WordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-23944

WordPress WOOEXIM Plugin <= 5.0.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-23932

WordPress Quick Count Plugin <= 3.00 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-23914

WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-22777

WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Givewp
Products
Givewp
CVE-2025-22526

WordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This issue affects PHP/MySQL CPU performance statistics: from n/a through <= 1.2.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-22510

WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-56291

WordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress