{"vulnerability": "CVE-2026-19658", "sightings": [{"uuid": "6e2469d2-190e-4be3-95ae-ccc59fc215a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19658", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw3gyuhfup2f", "content": "CVE-2026-19658 - give tributes\nThe Give Tributes add\u2011on for WordPress can be tricked into accepting specially crafted data when the \"Allow Multiple Recipients\" setting is turned on. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#givetributes #liquidweb #CVE #infosec", "creation_timestamp": "2026-09-22T05:00:09.647598Z"}, {"uuid": "943451cf-ecbf-4730-bebe-deb43f0d8bf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-19658", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117313164290215449", "content": "LiquidWeb Give Tributes <=2.3.1 is vulnerable (CVE-2026-19658, CRITICAL) to PHP Object Injection via unsafe deserialization. Only exploitable if a POP chain is present from other plugins/themes. Mitigate by disabling \"Allow Multiple Recipients\" or enabling eCard msg. https://radar.offseq.com/threat/cve-2026-19658-cwe-502-deserialization-of-untrusted-data-in-liquidweb-give-tributes-10b75c50779a09c2 #OffSeq #WordPress #CVE202619658", "creation_timestamp": "2026-09-22T06:00:29.483369Z"}, {"uuid": "6f3b8443-aa4e-4938-a293-eb190e4a6fdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-19658", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw3kerd2zq2z", "content": "LiquidWeb Give Tributes <=2.3.1 hit by CRITICAL PHP Object Injection (CVE-2026-19658). Exploitable if a POP chain exists via other plugins/themes. Disable \"Allow Multiple Recipients\" or enable eCard msg to reduce risk. https://radar.offseq.com/threat/cve-2026-19658-cwe-502-deserialization-of-untr...", "creation_timestamp": "2026-09-22T06:00:31.536200Z"}, {"uuid": "ed0d25e0-2756-40bb-93d6-a481c2576046", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19658", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw3kqy3tw322", "content": "\ud83d\udea8 CVE-2026-19658 \u2014 CVSS 9.8 CRITICAL\n\nThe Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-19658\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T06:07:20.055790Z"}, {"uuid": "4e1a1e08-6d1f-49cc-8312-9e60a46636f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19658", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103007", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-19658\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 06:37:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-22T10:00:06.718893Z"}, {"uuid": "ea332c4d-5bba-44fd-8844-a1aa57335bb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19658", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mw44wrggam2b", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cGive Tributes\u300d\u306bPHP\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u7279\u5b9a\u306e\u6761\u4ef6\u4e0b\u3067\u3001\u653b\u6483\u8005\u306f\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u524a\u9664\u3084\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-19658 CVSS 9.8 | CRITICAL", "creation_timestamp": "2026-09-22T11:32:41.835437Z"}, {"uuid": "13d6dd2e-fe14-42bc-bc15-fc718757809e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19658", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103007", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-19658\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 06:37:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T00:00:23.362906Z"}]}