PHP object injection in WordPress plugins

PHP object injection happens when a plugin unserializes data an attacker controls. On its own it often does nothing. It becomes dangerous when another plugin or theme on the same site contains a “gadget”, a piece of code that does something risky when such an object is loaded.

With a usable gadget this can lead to deleting files, reading data or running code. Many records say “no known gadget chain in the plugin itself”, which lowers the risk but does not remove it, because your other plugins count too.

What to do: update the plugin. Keep the total number of plugins down; every extra plugin is extra code an attacker might use.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest PHP object injection records

486 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

critical 9.8 PDF Invoice for WooCommerce + Drag and Drop Te…

PHP object injection

CVE-2026-109220 · affected 7.1.1 and older · fixed in 7.2.0 * · published 2026-10-31
critical 9.8 affects latest 1.25 LeadSnap

PHP object injection

CVE-2026-90888 · affected 1.25 and older · no fix listed yet · published 2026-10-30
high 8.8 affects latest 3.3.10 Solid Testimonials

PHP object injection

CVE-2026-78527 · affected 3.3.10 and older · no fix listed yet · published 2026-10-30
high 8.8 Enable Media Replace

PHP object injection

CVE-2026-73186 · affected 4.2.2 and older · fixed in 4.2.3 · published 2026-10-30
critical 9.8 FunnelKit Automations

PHP object injection

CVE-2026-39738 · affected 3.8.6.1 and older · fixed in 3.8.6.2 · published 2026-10-30
high 7.2 Product Feed Manager for WooCommerce

PHP object injection

CVE-2026-118089 · affected 7.14.1 and older · fixed in 7.14.2 · published 2026-10-30
high 8.8 MasterStudy LMS WordPress Plugin

PHP object injection

CVE-2026-118090 · affected 3.7.55 and older · fixed in 3.7.56 · published 2026-10-30
high 7.5 Enable Media Replace

PHP object injection

CVE-2026-114422 · affected 4.1.4 up to (not including) 4.2.3 · fixed in 4.2.3 · published 2026-10-30
critical 9.8 Zoho Flow

PHP object injection

CVE-2026-62131 · affected 2.14.5 and older · fixed in 2.14.6 * · published 2026-10-29
critical 9.8 GEO my WP

PHP object injection

CVE-2026-61992 · affected 4.5.5.3 and older · fixed in 4.5.5.4 · published 2026-10-29
high 7.2 YayMail

PHP object injection

CVE-2026-42701 · affected 4.4.6 and older · fixed in 4.4.7 · published 2026-10-29
high 7.2 affects latest 2.21.0 Finale Lite

PHP object injection

CVE-2026-118074 · affected 2.21.0 and older · no fix listed yet · published 2026-10-29
high 7.2 FV Flowplayer Video Player

PHP object injection

CVE-2026-118079 · affected 7.5.56.7212 and older · fixed in 7.5.57.7212 · published 2026-10-29
high 7.2 Product Catalog Feed by PixelYourSite

PHP object injection

CVE-2026-118078 · affected 3.1.4 and older · fix not stated · published 2026-10-29
high 8.8 Frisbii Pay

PHP object injection

CVE-2026-118076 · affected 1.8.19 and older · fixed in 1.8.20 * · published 2026-10-29
high 7.2 Spexo Addons for Elementor

PHP object injection

CVE-2026-118077 · affected 1.2.3 and older · fix not stated · published 2026-10-29
high 8.8 Social Snap

PHP object injection

CVE-2026-118080 · affected 1.5.4 and older · fix not stated · published 2026-10-29
high 8.8 10WebSocial

PHP object injection

CVE-2026-118081 · affected 1.5.6 and older · fix not stated · published 2026-10-29
high 8.8 WP Media folders

PHP object injection

CVE-2026-118075 · affected 1.1.10 and older · fix not stated · published 2026-10-29
high 8.8 affects latest 1.3.1 BuddyPress Xprofile Custom Field Types

PHP object injection

CVE-2026-116868 · affected 1.3.1 and older · no fix listed yet · published 2026-10-29
high 8.8 affects latest 1.0.1 Dynamic QR Code

PHP object injection

CVE-2026-116867 · affected 1.0.1 and older · no fix listed yet · published 2026-10-29
high 7.2 affects latest 1.4.5 myPOS Checkout

PHP object injection

CVE-2026-116869 · affected 1.4.5 and older · no fix listed yet · published 2026-10-29
high 8.8 affects latest 1.5.0 News Kit Addons For Elementor

PHP object injection

CVE-2026-118073 · affected 1.5.0 and older · no fix listed yet · published 2026-10-29
high 8.8 affects latest 4.4.0 Extra Fees for WooCommerce

PHP object injection

CVE-2026-116866 · affected 4.4.0 and older · no fix listed yet · published 2026-10-29
high 7.2 WPCargo Track & Trace

PHP object injection

CVE-2026-116864 · affected 8.0.5 and older · fixed in 8.0.6 * · published 2026-10-29
high 7.2 affects latest 1.7.0 Zippy

PHP object injection

CVE-2026-116865 · affected 1.7.0 and older · no fix listed yet · published 2026-10-29
critical 9.0 Frontend Dashboard

PHP object injection

CVE-2026-103693 · affected older than 3.0.5 · fixed in 3.0.5 · published 2026-10-29
high 7.2 Filter Everything

PHP object injection

CVE-2026-116390 · affected 1.9.7 and older · fixed in 1.9.8 * · published 2026-10-28
high 8.8 Phoenix Media Rename

PHP object injection

CVE-2026-116389 · affected 3.13.5 and older · fixed in 3.13.6 * · published 2026-10-28
critical 9.8 Ultimate Member

PHP object injection

CVE-2026-115968 · affected 2.13.1 and older · fixed in 2.14.0 · published 2026-10-28
high 7.2 Dokan

PHP object injection

CVE-2026-115590 · affected 5.3.1 and older · fixed in 5.3.2 · published 2026-10-28
high 7.2 affects latest 2.3.25 Accordions

PHP object injection

CVE-2026-116392 · affected 2.3.25 and older · no fix listed yet · published 2026-10-28
high 8.8 Logo Slider

PHP object injection

CVE-2026-116391 · affected 3.8.9 and older · fixed in 3.9.0 · published 2026-10-28
high 8.8 Rank Math SEO

PHP object injection

CVE-2026-1928 · affected 1.0.276 and older · fixed in 1.0.277 * · published 2026-10-28
high 8.8 Kirki

PHP object injection

CVE-2026-75891 · affected 6.2.5 and older · fixed in 6.3.0 * · published 2026-10-27
high 7.2 Relevanssi

PHP object injection

CVE-2026-114704 · affected 4.28.4 and older · fixed in 4.28.5 · published 2026-10-24
critical 9.8 Newsletters

PHP object injection

CVE-2026-94075 · affected 4.18.1 and older · fixed in 4.18.2 · published 2026-10-24
critical 9.8 Paytium

PHP object injection

CVE-2026-114196 · affected 5.0.5 and older · fixed in 5.0.6 · published 2026-10-24
critical 9.8 Prime Mover

PHP object injection

CVE-2026-115806 · affected 2.2.1 and older · fixed in 2.2.2 * · published 2026-10-24
critical 9.8 Participants Database

PHP object injection

CVE-2026-112862 · affected 2.7.8.5 and older · fix not stated · published 2026-10-23
high 8.8 GS Pinterest Portfolio

PHP object injection

CVE-2026-110370 · affected 1.9.2 and older · fixed in 1.9.3 · published 2026-10-21
high 8.8 Team Members

PHP object injection

CVE-2026-110369 · affected 2.8.2 and older · fixed in 2.8.3 · published 2026-10-21
high 8.8 Duplicator

PHP object injection

CVE-2026-82814 · affected 1.5.17 and older · fixed in 5.0.0 * · published 2026-10-21
high 8.8 Quiz and Survey Master (QSM)

PHP object injection

CVE-2026-111408 · affected 11.2.7 and older · fixed in 11.2.8 · published 2026-10-19
critical 9.8 WPBot

PHP object injection

CVE-2026-110886 · affected 1.5.1 and older · fixed in 1.5.2 · published 2026-10-18
high 8.8 Strong Testimonials

PHP object injection

CVE-2026-107436 · affected 3.3.12 and older · fixed in 3.3.13 · published 2026-10-18
critical 9.8 LearnPress

PHP object injection

CVE-2026-104736 · affected 4.4.10 and older · fixed in 4.4.11 * · published 2026-10-17
high 7.2 Kirki

PHP object injection

CVE-2026-104734 · affected 6.3.2 and older · fixed in 6.4.0 * · published 2026-10-17
critical 9.8 Sunshine Photo Cart

PHP object injection

CVE-2026-104730 · affected 3.7.4 and older · fixed in 3.7.5 * · published 2026-10-16
high 8.0 Search Regex

PHP object injection

CVE-2026-104932 · affected 3.5 and older · fixed in 3.5.1 * · published 2026-10-16
critical 9.8 Link Whisper Free

PHP object injection

CVE-2026-109686 · affected 0.9.7 and older · fixed in 0.9.8 · published 2026-10-15
high 7.2 Polylang

PHP object injection

CVE-2026-97278 · affected 3.8.9 and older · fixed in 3.8.10 · published 2026-10-14
critical 9.8 Affiliates

PHP object injection

CVE-2026-108291 · affected 7.0.1 and older · fixed in 7.1.0 · published 2026-10-14
high 8.8 SureCart

PHP object injection

CVE-2026-106599 · affected 4.9.3 and older · fixed in 4.9.4 · published 2026-10-14
high 7.2 Post Export Import with Media

PHP object injection

CVE-2026-104764 · affected 1.17.1 and older · fixed in 1.17.2 * · published 2026-10-14
high 7.2 WPML Multilingual & Multicurrency for WooComme…

PHP object injection

CVE-2026-62130 · affected 5.5.8 and older · fixed in 5.6.3 · published 2026-10-10
critical 9.8 affects latest 2.4 Dynamic User Directory

PHP object injection

CVE-2026-42719 · affected 2.4 and older · no fix listed yet · published 2026-10-10
critical 9.8 payever Checkout

PHP object injection

CVE-2026-42716 · affected 4.8.2 and older · fixed in 4.9.0 * · published 2026-10-10
critical 9.8 Booster for WooCommerce

PHP object injection

CVE-2026-42718 · affected 8.4.0 and older · fixed in 8.5.0 · published 2026-10-10
high 7.2 Super Video player

PHP object injection

CVE-2026-62044 · affected 1.8.13 and older · fixed in 1.8.14 * · published 2026-10-10
critical 9.8 AFFI

PHP object injection

CVE-2026-104398 · affected 1.0.10 and older · fixed in 1.0.11 · published 2026-10-10
high 7.2 Tainacan

PHP object injection

CVE-2026-94676 · affected 1.3.0 and older · fixed in 1.4.0 · published 2026-10-10
high 8.8 Slider by 10Web

PHP object injection

CVE-2026-105885 · affected 1.2.62 and older · fixed in 1.2.63 · published 2026-10-10
high 7.2 YITH WooCommerce Affiliates

PHP object injection

CVE-2026-106606 · affected 3.31.0 and older · fixed in 3.31.1 · published 2026-10-10
high 7.2 Online Scheduling and Appointment Booking System

PHP object injection

CVE-2026-12626 · affected 28.2 and older · fixed in 28.3 * · published 2026-10-10
high 8.8 LifterLMS

PHP object injection

CVE-2026-104723 · affected 10.2.1 and older · fixed in 10.3.0 * · published 2026-10-10
high 7.2 MKL Product Configurator for WooCommerce

PHP object injection

CVE-2026-105872 · affected 1.7.5 and older · fixed in 1.7.6 · published 2026-10-09
high 8.8 Quiz and Survey Master (QSM)

PHP object injection

CVE-2026-104392 · affected 11.2.7 and older · fixed in 11.2.8 · published 2026-10-09
high 7.2 Pay with Vipps and MobilePay for WooCommerce

PHP object injection

CVE-2026-94568 · affected 6.2.0 and older · fixed in 6.2.1 · published 2026-10-09
high 8.8 MainWP Child

PHP object injection

CVE-2026-105436 · affected 6.2.1 and older · fixed in 6.2.2 · published 2026-10-08
critical 9.8 The Events Calendar

PHP object injection

CVE-2026-95606 · affected 6.17.4 and older · fixed in 6.17.4.1 · published 2026-10-07
high 8.8 Unlimited Elements for Elementor

PHP object injection

CVE-2026-95534 · affected 2.0.19 and older · fixed in 2.0.20 · published 2026-10-07
critical 9.8 The GDPR Framework By Data443

PHP object injection

CVE-2026-39797 · affected 2.5.0 and older · fixed in 2.5.1 * · published 2026-10-06
high 8.8 Simple Event Planner

PHP object injection

CVE-2026-97257 · affected 1.5.7 and older · fixed in 1.5.8 · published 2026-10-05
high 7.2 Sunshine Photo Cart

PHP object injection

CVE-2026-93617 · affected 3.7.1 and older · fixed in 3.7.2 · published 2026-10-05
high 7.2 Export All Posts, Products, Orders & Users

PHP object injection

CVE-2026-103348 · affected 3.0 and older · fixed in 3.1 · published 2026-10-05
high 8.8 VK Google Job Posting Manager

PHP object injection

CVE-2026-100511 · affected 1.3.1 and older · fixed in 1.3.2 · published 2026-10-05
high 7.2 WP Spell Check

PHP object injection

CVE-2026-100506 · affected 12.1 and older · fixed in 12.2 · published 2026-10-05
critical 9.8 Advanced Post Manager

PHP object injection

CVE-2026-97283 · affected 4.5.5 and older · fixed in 4.5.6 · published 2026-10-05
high 7.2 Product Feed PRO for WooCommerce by AdTribes

PHP object injection

CVE-2026-103349 · affected 13.5.7 and older · fixed in 13.5.8 * · published 2026-10-05
high 8.8 Icegram Engage

PHP object injection

CVE-2026-97284 · affected 3.1.31 and older · fixed in 3.1.44 · published 2026-10-01
high 7.2 Hide Shipping Method For WooCommerce

PHP object injection

CVE-2026-94390 · affected 1.5.4 and older · fixed in 1.5.5 · published 2026-10-01
high 8.8 Schema & Structured Data for WP & AMP

PHP object injection

CVE-2026-97291 · affected 1.66 and older · fixed in 1.67 · published 2026-09-30
high 7.2 Page Builder by SiteOrigin

PHP object injection

CVE-2026-97256 · affected 2.36.0 and older · fixed in 2.36.1 · published 2026-09-30
high 8.8 Photo Gallery by 10Web

PHP object injection

CVE-2026-102377 · affected 1.8.46 and older · fixed in 1.8.47 · published 2026-09-30
high 7.2 Extra Product Options For WooCommerce

PHP object injection

CVE-2026-102392 · affected 3.3.8 and older · fixed in 3.3.9 · published 2026-09-30
critical 9.8 Nested Pages

PHP object injection

CVE-2026-100512 · affected 3.3.2 and older · fixed in 3.3.3 · published 2026-09-30
critical 9.8 Booking Activities

PHP object injection

CVE-2026-97248 · affected 1.18.7.1 and older · fixed in 1.18.8 · published 2026-09-30
medium 4.9 ShortPixel Image Optimizer

PHP object injection

CVE-2026-97246 · affected 6.5.5 and older · fixed in 6.5.6 · published 2026-09-30
high 7.2 Content Egg

PHP object injection

CVE-2026-96832 · affected 6.3.1 and older · fixed in 11.9.0 · published 2026-09-30
high 7.2 Ultra Addons for Contact Form 7

PHP object injection

CVE-2026-96833 · affected 3.5.51 and older · fixed in 3.5.52 · published 2026-09-30
high 8.8 Themify Builder

PHP object injection

CVE-2026-96831 · affected 7.8.1 and older · fixed in 7.8.2 · published 2026-09-30
high 7.2 eCommerce Product Catalog

PHP object injection

CVE-2026-96344 · affected 3.6.0 and older · fixed in 3.6.1 · published 2026-09-30
high 7.2 ERP

PHP object injection

CVE-2026-96343 · affected 1.17.9 and older · fixed in 1.17.10 · published 2026-09-30
high 8.8 WPBot

PHP object injection

CVE-2026-95531 · affected 1.5.0 and older · fixed in 1.5.1 · published 2026-09-30
high 8.8 DesignSetGo

PHP object injection

CVE-2026-94683 · affected 2.8.0 and older · fixed in 2.8.1 · published 2026-09-30
high 8.8 Go Live Update Urls

PHP object injection

CVE-2026-94678 · affected 7.0.8 and older · fixed in 7.1.0 · published 2026-09-30
high 7.2 Kadence WooCommerce Email Designer

PHP object injection

CVE-2026-94677 · affected 1.5.19.1 and older · fixed in 1.5.19.2 · published 2026-09-30
high 7.2 Responsive Slider Gallery

PHP object injection

CVE-2026-94122 · affected 1.5.5 and older · fixed in 1.5.6 · published 2026-09-30
high 8.8 10Web Booster

PHP object injection

CVE-2026-94121 · affected 2.33.6 and older · fixed in 2.34.0 · published 2026-09-30

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan