Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2026-93933

WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Rosalinda Rosalinda
CVE-2026-93932

WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Smart Casa Smart Casa
CVE-2026-93931

WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Smash Smash
CVE-2026-93930

WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-93929

WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-93927

WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62130

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62046

WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Gutentype Gutentype
CVE-2026-62045

WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Booklovers Booklovers
CVE-2026-62044

WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62021

WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-106606

WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105885

WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105872

WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-81797

WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-78535

WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-78533

WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-78531

WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-78529

WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-66569

WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—