PressLayouts vulnerabilities and threats

CVE-2026-39445 is a high-severity vulnerability in PressLayouts Alukas versions prior to 3.0.0. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code, impacting confidentiality, integrity, and availability of the affected system.

CVE-2026-39442 is a high severity vulnerability in PressLayouts PressMart affecting versions up to and including 1.2.26. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code or cause denial of service without requiring authentication.

CVE-2026-41557 is a high-severity vulnerability in PressLayouts Kapee versions prior to 1.7.1. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently confirmed.

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.