Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
criticalThe Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulner...
- CVSS:
- 9.8 (Wordfence)
- Affected:
- up to 2.3.1
- Fixed in:
- 2.3.1.1
- Disclosed:
- Sep 21, 2026