{"metadata": {"vulnerability": "CVE-2026-19658", "count": 25, "kinds": {"milestone": 4, "sighting": 11, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-06-22T15:57:53Z", "date_only": false, "value": "2026-06-22T15:57:53.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19658", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-08-12T18:57:11.799Z", "date_only": false, "value": "2026-08-12T18:57:11.799Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19658", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-21T15:55:06Z", "date_only": false, "value": "2026-09-21T15:55:06.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19658", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-09-22T04:27:38.713Z", "date_only": false, "value": "2026-09-22T04:27:38.713Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19658", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-22T04:27:38.713Z", "date_only": false, "value": "2026-09-22T04:27:38.713Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19658", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-22T05:00:09.647Z", "date_only": false, "value": "2026-09-22T05:00:09.647598Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw3gyuhfup2f", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "6e2469d2-190e-4be3-95ae-ccc59fc215a3", "content": "CVE-2026-19658 - give tributes\nThe Give Tributes add\u2011on for WordPress can be tricked into accepting specially crafted data when the \"Allow Multiple Recipients\" setting is turned on. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#givetributes #liquidweb #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mw3gyuhfup2f"}, {"timestamp": "2026-09-22T05:16:55Z", "date_only": false, "value": "2026-09-22T05:16:55Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WQ6Q-GX9M-7669", "record": "GHSA-WQ6Q-GX9M-7669", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-22T05:16:55.167Z", "date_only": false, "value": "2026-09-22T05:16:55.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19658", "record": "FKIE_CVE-2026-19658", "field": "published"}, {"timestamp": "2026-09-22T06:00:29.483Z", "date_only": false, "value": "2026-09-22T06:00:29.483369Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117313164290215449", "record": "cve-2026-19658", "field": "creation_timestamp", "uuid": "943451cf-ecbf-4730-bebe-deb43f0d8bf3", "content": "LiquidWeb Give Tributes <=2.3.1 is vulnerable (CVE-2026-19658, CRITICAL) to PHP Object Injection via unsafe deserialization. Only exploitable if a POP chain is present from other plugins/themes. Mitigate by disabling \"Allow Multiple Recipients\" or enabling eCard msg. https://radar.offseq.com/threat/cve-2026-19658-cwe-502-deserialization-of-untrusted-data-in-liquidweb-give-tributes-10b75c50779a09c2 #OffSeq #WordPress #CVE202619658", "url": "https://infosec.exchange/users/offseq/statuses/117313164290215449"}, {"timestamp": "2026-09-22T06:00:31.536Z", "date_only": false, "value": "2026-09-22T06:00:31.536200Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw3kerd2zq2z", "record": "cve-2026-19658", "field": "creation_timestamp", "uuid": "6f3b8443-aa4e-4938-a293-eb190e4a6fdb", "content": "LiquidWeb Give Tributes <=2.3.1 hit by CRITICAL PHP Object Injection (CVE-2026-19658). Exploitable if a POP chain exists via other plugins/themes. Disable \"Allow Multiple Recipients\" or enable eCard msg to reduce risk. https://radar.offseq.com/threat/cve-2026-19658-cwe-502-deserialization-of-untr...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mw3kerd2zq2z"}, {"timestamp": "2026-09-22T06:07:20.055Z", "date_only": false, "value": "2026-09-22T06:07:20.055790Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw3kqy3tw322", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "ed0d25e0-2756-40bb-93d6-a481c2576046", "content": "\ud83d\udea8 CVE-2026-19658 \u2014 CVSS 9.8 CRITICAL\n\nThe Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-19658\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mw3kqy3tw322"}, {"timestamp": "2026-09-22T06:30:24Z", "date_only": false, "value": "2026-09-22T06:30:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WQ6Q-GX9M-7669", "record": "GHSA-WQ6Q-GX9M-7669", "field": "published"}, {"timestamp": "2026-09-22T06:30:24Z", "date_only": false, "value": "2026-09-22T06:30:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WQ6Q-GX9M-7669", "record": "GHSA-WQ6Q-GX9M-7669", "field": "modified"}, {"timestamp": "2026-09-22T10:00:06.718Z", "date_only": false, "value": "2026-09-22T10:00:06.718893Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103007", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "4e1a1e08-6d1f-49cc-8312-9e60a46636f4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-19658\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 06:37:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103007"}, {"timestamp": "2026-09-22T10:10:29.938Z", "date_only": false, "value": "2026-09-22T10:10:29.938501Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19658", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-22T10:10:29.938Z", "date_only": false, "value": "2026-09-22T10:10:29.938501Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19658", "record": "FKIE_CVE-2026-19658", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-22T10:25:33.429Z", "date_only": false, "value": "2026-09-22T10:25:33.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19658", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-22T10:25:33.429Z", "date_only": false, "value": "2026-09-22T10:25:33.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19658", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-22T11:02:28Z", "date_only": false, "value": "2026-09-22T11:02:28.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Ffi85eeavW2D358GX6UTlFPgijogrCPT-3RZhUXbdJmuK2g", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "48eb0ed9-1166-4a0d-a45a-78e32611c8fc"}, {"timestamp": "2026-09-22T11:02:28Z", "date_only": false, "value": "2026-09-22T11:02:28.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Ffi85eeavW2D358GX6UTlFPgijogrCPT-3RZhUXbdJmuK2g", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "2b5c8c4f-5d7d-4638-bab7-135ed9652022"}, {"timestamp": "2026-09-22T11:32:41.835Z", "date_only": false, "value": "2026-09-22T11:32:41.835437Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mw44wrggam2b", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "ea332c4d-5bba-44fd-8844-a1aa57335bb6", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cGive Tributes\u300d\u306bPHP\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u7279\u5b9a\u306e\u6761\u4ef6\u4e0b\u3067\u3001\u653b\u6483\u8005\u306f\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u524a\u9664\u3084\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-19658 CVSS 9.8 | CRITICAL", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mw44wrggam2b"}, {"timestamp": "2026-09-22T15:00:07Z", "date_only": false, "value": "2026-09-22T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/tRGJvhGul_vE60BKtV9RMDKpw0AGHjXygS1hBVz2YWgBcAA", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "a60809e5-9717-4e06-a39a-125055c86bf6"}, {"timestamp": "2026-09-22T15:00:07Z", "date_only": false, "value": "2026-09-22T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/tRGJvhGul_vE60BKtV9RMDKpw0AGHjXygS1hBVz2YWgBcAA", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "5fae2064-ef62-4810-9581-14f0eeb8a451"}, {"timestamp": "2026-09-22T19:04:55.677Z", "date_only": false, "value": "2026-09-22T19:04:55.677", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19658", "record": "FKIE_CVE-2026-19658", "field": "lastModified"}, {"timestamp": "2026-10-11T08:50:05.843Z", "date_only": false, "value": "2026-10-11T08:50:05.843979Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117421414988713142", "record": "CVE-2026-19658", "field": "creation_timestamp", "uuid": "be006877-c8e0-4ae0-a416-6c21079613e0", "content": "CVE-2026-19658: PHP Object Injection in GiveWP Give Tributes plugin, all versions up to 2.3.1. CVSS 9.8, unauthenticated. No patch yet - remove the plugin or update immediately.https://www.valtersit.com/cve/CVE-2026-19658/#CVE #WordPress #infosec", "url": "https://mastodon.social/users/hugovalters/statuses/117421414988713142"}]}