CVE-2026-62045

WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Group Wordpress-extensions

Products

Booklovers Booklovers

CVE-2026-62044

WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62021

WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-106606

WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105885

WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105872

WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-81797

WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-78535

WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-78533

WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-78531

WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-78529

WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66569

WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66568

WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66567

WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66565

WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66564

WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66563

WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66483

WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66482

WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62125

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—