CVE-2026-40733 is a high-severity vulnerability in Mikado-Themes ShiftUp versions 1.3 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without requiring authentication.
CVE-2026-39576 is a high-severity vulnerability in Elated-Themes SingleMalt versions up to and including 1.5. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-39560 is a high-severity vulnerability in Select-Themes Hiroshi versions up to and including 1.5.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without requiring authentication.
CVE-2026-39556 is a high severity vulnerability affecting Elated-Themes Konsept versions up to and including 1.9. It involves unauthenticated PHP object injection, categorized under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-39445 is a high-severity vulnerability in PressLayouts Alukas versions prior to 3.0.0. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code, impacting confidentiality, integrity, and availability of the affected system.
CVE-2026-39442 is a high severity vulnerability in PressLayouts PressMart affecting versions up to and including 1.2.26. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code or cause denial of service without requiring authentication.
Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection.
This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.
CVE-2025-69127 is a critical vulnerability in ThemeREX Plumbing versions up to and including 1.6. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. This vulnerability allows an attacker to execute arbitrary code without any authentication. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2025-69111 is a critical vulnerability in ThemeREX Reisen versions up to and including 1.4.1. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.
Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in its Client Update Service due to insecure deserialization in the .NET Remoting service. The service uses TypeFilterLevel.Full and is accessible only via local named pipes. An authenticated local attacker can exploit this by sending crafted serialized objects, resulting in arbitrary code execution with SYSTEM privileges. Network exploitation is not possible, and local authenticated access is required.
CVE-2026-54806 is a critical vulnerability in Melapress WP Activity Log versions up to and including 5.6.3.1. It involves unauthenticated PHP object injection, classified under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows an attacker to execute arbitrary code without any authentication. The CVSS score is 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-52706 is a critical vulnerability in Jetimpex Inc.'s JetEngine product affecting versions up to and including 3.8.10. It involves unauthenticated PHP object injection, classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability allows remote attackers to execute arbitrary code without any authentication. The CVSS v3.1 base score is 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-49107 is a critical vulnerability in Thrive Themes Thrive Apprentice versions prior to 10.8.10.2. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This vulnerability allows an attacker to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.
CVE-2026-40753 is a high-severity vulnerability in Mikado-Themes EasyMeals versions up to and including 1.5.1. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This vulnerability allows an attacker to execute arbitrary code or cause denial of service without requiring authentication.
CVE-2026-40735 is a high-severity vulnerability in Edge-Themes Reina versions up to and including 2.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows an attacker to potentially execute arbitrary code or cause denial of service without requiring authentication. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-40725 is a critical vulnerability in Barn2 Media Ltd's WooCommerce Product Filters plugin versions prior to 2.0.6. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication. The CVSS 3.1 base score is 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently confirmed. Users should monitor vendor advisories for updates and consider upgrading once a fix is released.
CVE-2026-39573 is a high-severity vulnerability in Select-Themes Mildhill versions up to and including 1.5. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code or cause denial of service without requiring authentication. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-39545 is a high-severity vulnerability in Select-Themes Zermatt versions up to and including 1.6.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without requiring authentication.