CVE-2026-61992

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54860

WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54857

WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54856

WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42701

WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118078

WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118073

WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116869

WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116866

WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116865

WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability

Editor PHP Object Injection in Zippy <= 1.7.0 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116864

WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-61803

Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Lms

CVE-2026-104324

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-104317

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-59396

DoS Vulnerability in UAA Related to JWKS URI Handling

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Cf-deployment Uaa

CVE-2026-45145

Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Chamilo

Products

Chamilo Lms

CVE-2026-119706

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

CVSS 4.0 · 9.3 Critical EPSS 1.0% KEV · Not listed

Vendors

Internlm

Products

Lmdeploy

CVE-2026-114422

Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Enable Media Replace

CVE-2026-65902

DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-62018

WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—