Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 14 of 37
Dec 18, 2025An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48CVE-2025-63951 · Other software · Sourcefabric · reported by MITREHigh 7.5
An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07). The 'rss' GET parameter receives data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, causing the application to process them and leading to errors or a denial of service.
- Product
- Phoniebox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca2907796213CVE-2025-63950 · Other software · Tomaszdunia · reported by MITREHigh 7.5
An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service.
- Product
- Twittodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-64266 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.
- Product
- Booking and Rental Manager
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Codiqa: Deserialization of Untrusted DataCVE-2025-64233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
- Product
- Codiqa
- What to do
- Update Codiqa to the newest version.
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Jannah: Deserialization of Untrusted DataCVE-2025-64206 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
- Product
- Jannah
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Salesforce: Deserialization of Untrusted DataCVE-2025-60180 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.
- Product
- WP Gravity Forms Salesforce
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms HubSpot: Deserialization of Untrusted DataCVE-2025-60178 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.
- Product
- WP Gravity Forms HubSpot
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Constant Contact: Deserialization of Untrusted DataCVE-2025-60174 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.
- Product
- WP Gravity Forms Constant Contact
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Zoho CRM and Bigin: Deserialization of Untrusted DataCVE-2025-60091 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
- Product
- WP Gravity Forms Zoho CRM and Bigin
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Insightly: Deserialization of Untrusted DataCVE-2025-60090 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.
- Product
- WP Gravity Forms Insightly
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update WP Gravity Forms Insightly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms FreshDesk: Deserialization of Untrusted DataCVE-2025-60089 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
- Product
- WP Gravity Forms FreshDesk
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF for Elementor Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60084 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
- Product
- PDF for Elementor Forms + Drag And Drop Template Builder
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
- Product
- PDF Invoice Builder for WooCommerce
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF for WPForms: Deserialization of Untrusted DataCVE-2025-60082 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.
- Product
- PDF for WPForms
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF for Contact Form 7: Deserialization of Untrusted DataCVE-2025-60081 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.
- Product
- PDF for Contact Form 7
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF for Gravity Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60080 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
- Product
- PDF for Gravity Forms + Drag And Drop Template Builder
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF for Gravity Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025DentiCare: Deserialization of Untrusted DataCVE-2025-54723 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.
- Product
- DentiCare
- What to do
- Update DentiCare to the newest version.
Dec 16, 2025NVIDIA Isaac Lab contains a deserialization vulnerability.CVE-2025-33210 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9
NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution.
- Product
- Isaac Lab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Dec 16, 2025Fancy Product Designer: Information Disclosure and PHAR DeserializationCVE-2025-13439 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
- Product
- Fancy Product Designer
- Affected
- up to 6.4.8
- What to do
- Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Dec 15, 2025MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool.CVE-2025-65213 · Other software · Mthreads · reported by MITRECritical 9.8
MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process.
- Product
- Torch Musa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store.CVE-2025-26866 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue.
- Product
- Apache HugeGraph-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Dec 9, 2025ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code eCVE-2025-61810 · Websites & servers · Adobe · reported by AdobeHigh 8.4
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization.CVE-2025-13743 · Other software · Docker · reported by security@docker.comLow 2.4
Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensitive information in exported diagnostics, especially when access denied errors occurred.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue.CVE-2025-33214 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.8
NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- Product
- NVTabular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Dec 9, 2025NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue.CVE-2025-33213 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.8
NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- Product
- Merlin Transformers4Rec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Dec 9, 2025WP Maps: Deserialization of Untrusted DataCVE-2025-67535 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
- Product
- WP Maps
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution.CVE-2025-42928 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.
- Product
- SAP jConnect - SDK for ASE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025WP Webhooks: Deserialization of Untrusted DataCVE-2025-66073 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.
- Product
- WP Webhooks
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update WP Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Email Subscribers & Newsletters: Deserialization of Untrusted DataCVE-2025-66055 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & Newsletters: from n/a through <= 5.9.10.
- Product
- Email Subscribers & Newsletters
- Affected
- up to 5.9.10
- What to do
- Affects up to 5.9.10. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2025Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters.CVE-2025-64408 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.3
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
- Product
- Apache Causeway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Nov 18, 2025Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attaCVE-2025-60455 · Other software · Modular · reported by MITREHigh 8.4
Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.
- Product
- MAX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserializationCVE-2025-11367 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 10
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-62204 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability.CVE-2025-63617 · Other software · Kutangguo · reported by MITREMedium 6.5
ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data.
- Product
- Ktg-mes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 6, 2025Togo: Deserialization of Untrusted DataCVE-2025-62035 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
- Product
- Togo
- What to do
- Update Togo to the newest version.
Nov 6, 2025WP User Manager: Deserialization of Untrusted DataCVE-2025-60245 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
- Product
- WP User Manager
- Affected
- up to 2.9.12
- What to do
- Affects up to 2.9.12. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025s2Member: Deserialization of Untrusted DataCVE-2025-58998 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
- Product
- s2Member
- Affected
- up to 250701
- What to do
- Affects up to 250701. Update s2Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WP Gravity Forms Keap/Infusionsoft: Deserialization of Untrusted DataCVE-2025-58636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
- Product
- WP Gravity Forms Keap/Infusionsoft
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Falang multilanguage: Deserialization of Untrusted DataCVE-2025-58619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through <= 1.3.65.
- Product
- Falang multilanguage
- Affected
- up to 1.3.65
- What to do
- Affects up to 1.3.65. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TranslatePress: Deserialization of Untrusted DataCVE-2025-58592 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
- Product
- TranslatePress
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Yogi - Health Beauty & Yoga: Deserialization of Untrusted DataCVE-2025-54719 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
- Product
- Yogi - Health Beauty & Yoga
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Yogi - Health Beauty & Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WeMusic: Deserialization of Untrusted DataCVE-2025-53586 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.
- Product
- WeMusic
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update WeMusic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Seil: Deserialization of Untrusted DataCVE-2025-53242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
- Product
- Seil
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Seil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Sign-up Sheets: Deserialization of Untrusted DataCVE-2025-49393 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
- Product
- Sign-up Sheets
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Preserve Code Formatting: Deserialization of Untrusted DataCVE-2025-49386 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.
- Product
- Preserve Code Formatting
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Preserve Code Formatting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Ajax Search Lite: Deserialization of Untrusted DataCVE-2025-48086 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
- Product
- Ajax Search Lite
- Affected
- up to 4.13.3
- What to do
- Affects up to 4.13.3. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Polylang: Deserialization of Untrusted DataCVE-2025-64353 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through <= 3.7.3.
- Product
- Polylang
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2025iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.CVE-2025-50739 · Other software · reported by MITRECritical 9.8
iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comomnitools.app
Oct 27, 2025Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data.CVE-2025-34292 · Other software · BeWelcome · reported by VulnCheckCritical 9.4
Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is passed to PHP's unserialize(): the POST parameter `formkit_memory_recovery` in \\RoxPostHandler::getCallbackAction and the 'memory cookie' read by \\RoxModelBase::getMemoryCookie (bwRemember). (1) If present, `formkit_memory_recovery` is processed and passed to unserialize(), and (2) restore-from-memory functionality calls unserialize() on the bwRemember cookie value. Gadget chains present in Rox and bundled libraries enable exploitation of object injection to write arbitrary files or achieve remote code execution. Successful exploitation can lead to full site compromise. This vulnerability was remediated with commit c60bf04 (2025-06-16).
- Product
- Rox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.