Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included' shortcode attribute. This is due to the deserialization of untrusted input supplied via the 'included' parameter of the plugin's shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-07 | 4 | Disclosure4 |
| 2026-03-12 | 1 | Disclosure1 |
CVE-2026-2020 PHP Object Injection in WordPress JS Archive List Plugin via Shortcode Attribute https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2020
Post summary
The post announces a CVE‑2026‑2020 PHP Object Injection vulnerability affecting the WordPress JS Archive List Plugin via a shortcode attribute, without details on PoC, exploitation, or patches.
CVE-2026-2020 (CVSS:7.5, HIGH) is Awaiting Analysis. The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1..https://nvd.nist.gov/vuln/detail/CVE-2026-2020 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces that CVE-2026-2020 affects the JS Archive List WordPress plugin via PHP Object Injection, with a CVSS 7.5 score, and notes that it is awaiting analysis without mentioning any PoC, exploit, patch, or active exploitation evidence.
🚨*CVE* CVE-2026-2020 The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included' shortcode attribute. This … https://www.cve.org/CVERecord?id=CVE-2026-2020 ----- Traducción: CVE-2026-2020 El … http://infoflow.cloud`
Post summary
CVE‑2026‑2020 reveals a PHP Object Injection flaw in the JS Archive List WordPress plugin (up to v6.1.7) via the 'included' shortcode. No PoC, exploit, patch, or active exploitation is reported.
CVE-2026-2020 The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included' shortcode attribute. This … https://www.cve.org/CVERecord?id=CVE-2026-2020
Post summary
The text reports a PHP Object Injection vulnerability discovered in the JS Archive List WordPress plugin, noting the affected versions but providing no proof of exploitation or mitigation.
CVE Alert: CVE-2026-2020 - skatox - JS Archive List - https://www.redpacketsecurity.com/cve-alert-cve-2026-2020-skatox-js-archive-list/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-2020 #skatox #js-archive-list
Post summary
The post announces CVE-2026-2020 (skatox – JS Archive List) via a RedPacket Security alert link, but provides no further technical or mitigation details.