CWE-502: Deserialization of Untrusted Data vulnerabilities

1,290 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.8	EPSS 0.3%	CVE-2026-102377Photo Gallery by 10Web (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-102377 Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. EPSS 0.3%Vulnerability CWE-502	CVE Database V5	2026-09-30
Critical	9.8	EPSS 0.3%	CVE-2026-100512Nested Pages (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100512 Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions. EPSS 0.3%Vulnerability Hook & Filter CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.3%	CVE-2026-97291Magazine3 Schema & Structured Data for WP & AMP · Deserialization of Untrusted Data High8.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97291 Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions. EPSS 0.3%Vulnerability CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.3%	CVE-2026-97256Page Builder by SiteOrigin (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97256 Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions. EPSS 0.3%Vulnerability Greg – SiteOrigin CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.3%	CVE-2026-103441The Wikimedia Foundation MediaWiki Wikibase extension · Deserialization of Untrusted Data High7.2EPSS 0.3%2026-09-30CVE Database V5CVE-2026-103441 Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43. EPSS 0.3%Vulnerability CWE-502	CVE Database V5	2026-09-30
Critical	9.8	EPSS 0.4%	CVE-2026-97248Booking Activities (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-97248 Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. EPSS 0.4%Vulnerability Booking Activities Team CWE-502	CVE Database V5	2026-09-30
Medium	4.9	EPSS 0.2%	CVE-2026-97246ShortPixel Image Optimizer (WordPress plugin) · Deserialization of Untrusted Data Medium4.9EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97246 CVE-2026-97246 is a deserialization of untrusted data vulnerability in the ShortPixel Image Optimizer plugin for WordPress. It allows object injection, potentially leading to partial compromise of confidentiality and integrity. The issue affects versions from initial release up to 6.5.5. The vulnerability has a medium severity rating with a CVSS score of 4.9. No official patch or remediation details are provided in the available data. EPSS 0.2%Vulnerability CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-96833Ultimate Addons for Contact Form 7 (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-96833 Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions. EPSS 0.4%Vulnerability Themefic CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-96832Content Egg (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-96832 Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. EPSS 0.4%Vulnerability keywordrush CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.3%	CVE-2026-96831Themify Builder (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-96831 Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. EPSS 0.3%Vulnerability themifyme CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-96344eCommerce Product Catalog (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-96344 Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. EPSS 0.4%Vulnerability impleCode CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-96343weDevs WP ERP · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-96343 Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. EPSS 0.4%Vulnerability CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.5%	CVE-2026-95531Conversational Forms for ChatBot (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.5%2026-09-30CVE Database V5CVE-2026-95531 Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions. EPSS 0.5%Vulnerability QuantumCloud CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.3%	CVE-2026-94683DesignSetGo (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94683 Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. EPSS 0.3%Vulnerability Justin Nealey CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.4%	CVE-2026-94678Go Live Update Urls (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94678 Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. EPSS 0.4%Vulnerability Mat Lipe CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-94677Kadence WooCommerce Email Designer (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94677 Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. EPSS 0.4%Vulnerability Nexcess CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-94122Responsive Slider Gallery (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94122 Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. EPSS 0.4%Vulnerability A WP Life CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.4%	CVE-2026-9412110Web Booster (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94121 Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions. EPSS 0.4%Vulnerability CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.3%	CVE-2026-94076SEO Plugin by Squirrly SEO · Deserialization of Untrusted Data High8.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94076 Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions. EPSS 0.3%Vulnerability SEO Squirrly CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-93771Cost of Goods for WooCommerce (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-93771 Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions. EPSS 0.4%Vulnerability WPFactory CWE-502	CVE Database V5	2026-09-30

Page 12 of 66