CVE-2026-62021 is a high severity vulnerability in rascals Angio versions up to and including 1.1.1. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-42723 is a critical vulnerability in AncoraThemes CleanSkin version 1.5.0 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified as CWE-502. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-42719 is a critical vulnerability in Sarah Giles Dynamic User Directory versions 2.4 and earlier. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction.
CVE-2026-42718 is a critical vulnerability in Booster for WooCommerce, a plugin by Pluggabl. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data in versions up to and including 8.4.0. This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-42716 is a critical vulnerability in the Payever - WooCommerce Gateway plugin, affecting versions up to and including 4.8.2. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a high CVSS score of 9.8, indicating severe impact if exploited.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin versions up to 1.0.10. This flaw allows object injection, potentially leading to full system compromise without requiring user interaction or privileges. The vulnerability has a CVSS 3.1 score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
A deserialization of untrusted data vulnerability (CWE-502) exists in bPlugins Super Video Player up to version 1.8.13. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No patch or remediation information is currently provided.
A deserialization of untrusted data vulnerability (CWE-502) exists in Tainacan Community Tainacan, allowing object injection. This affects versions up to and including 1.3.0. The vulnerability has a high severity with a CVSS score of 7.2, indicating potential for high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-62045) exists in ThemeREX Group Booklovers plugin up to version 2.13.0. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
A critical deserialization of untrusted data vulnerability (CVE-2026-62046) exists in ThemeREX Group Gutentype up to version 2.1.12. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-93944) exists in ThemeREX Group Camelia, allowing object injection. This affects Camelia versions up to and including 1.2.15. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, potentially leading to complete system compromise.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in ThemeREX Group Convex up to version 1.16.0. This flaw allows an attacker to perform object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high severity. No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in ThemeREX Group's Dwell theme, allowing object injection. This affects versions up to and including 1.16.0. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-93941) exists in ThemeREX Group Edema, allowing object injection. This affects versions up to 1.2.2.2. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
A critical deserialization of untrusted data vulnerability (CVE-2026-93940) exists in ThemeREX Group Greeny up to version 2.10.0. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, indicating high severity. No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-93938) exists in ThemeREX Group Hogwords plugin versions up to 1.2.7. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, indicating a network exploitable issue with no privileges or user interaction required.
A critical deserialization of untrusted data vulnerability (CVE-2026-93937) exists in ThemeREX Group Hygia, allowing object injection. This affects versions up to and including 1.21.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in ThemeREX Group IPharm ipharm, allowing object injection. This affects versions up to and including 1.2.4. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch information is currently available.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in ThemeREX Group's Let's Play playhockey plugin, allowing object injection. This affects versions up to and including 1.1.15. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, resulting in complete confidentiality, integrity, and availability compromise.
A critical deserialization of untrusted data vulnerability (CVE-2026-93934) exists in ThemeREX Group's Partiso software, allowing object injection. This affects Partiso versions up to and including 1.1.13. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.