CVE Watch6 oct 2026

CVE-2026-103348

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This i

CVSS

7.2

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 5 oct 2026 · Última mod.: 6 oct 2026 · CWE-502

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/wp-ultimate-exporter/vulnerability/wordpress-wp-ultimate-exporter-plugin-3-0-php-object-injection-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-103831—

—

———CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.11h CVE-2026-397979.8 CRÍ

—

———Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.11h CVE-2026-1047478.1 ALT

—

———Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.11h CVE-2026-829887.5 ALT

—

——0There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint11h CVE-2026-972578.8 ALT

—

——0Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.11h CVE-2026-936177.2 ALT

—

——0Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.11h