Deserialization

Everything Threat Times has reported about Deserialization: 14 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Critical Deserialization Flaw in Square Squash Allows Remote Code Execution

Threat TimesOct 12, 2026

An unauthenticated attacker can trigger arbitrary Ruby code execution in Square Squash by storing crafted YAML data via a public API endpoint.

Vulnerabilities

VillaTheme AFFI Plugin Has Critical Object Injection Vulnerability

Threat TimesOct 10, 2026

A CVSS 9.8 flaw in VillaTheme AFFI – Affiliate Marketing for WooCommerce allows object injection through untrusted data deserialization.

Vulnerabilities

Critical Deserialization Flaw Found in Axiomthemes Veto Plugin Up to 1.6.0

Threat TimesOct 10, 2026

The National Vulnerability Database rates CVE-2026-93927 as critical, warning that untrusted data deserialization allows object injection in Axiomthemes Veto.

Vulnerabilities

ThemeREX Smash Plugin Faces Critical Deserialization Flaw in Versions Up to 1.12.0

Threat TimesOct 10, 2026

The National Vulnerability Database lists CVE-2026-93931 as critical, exposing users of older Smash plugin versions to remote object injection risks.

Vulnerabilities

Critical Object Injection Flaw Found in ThemeREX Tantra CMS Versions Up to 2.9.0

Threat TimesOct 10, 2026

The National Vulnerability Database rates CVE-2026-93930 as critical, citing untrusted data deserialization risks in the popular web platform.

Vulnerabilities

Let's Play Plugin Critical Flaw CVE-2026-93935 Allows Object Injection

Threat TimesOct 10, 2026

The National Vulnerability Database rates a deserialization flaw in ThemeREX Group's Let's Play plugin as critical, affecting versions through 1.1.15.

Vulnerabilities

Critical Deserialization Flaw Found in ThemeREX Edema Plugin Versions Up to 1.2.2.2

Threat TimesOct 10, 2026

A severe object injection vulnerability in ThemeREX Group Edema allows untrusted data deserialization, posing a high risk to affected installations.

Vulnerabilities

Critical object injection flaw found in ThemeREX Hogwords plugin

Threat TimesOct 10, 2026

A CVSS 9.8 vulnerability in ThemeREX Hogwords allows untrusted data deserialization, affecting versions up to 1.2.7.

Vulnerabilities

Hygia Plugin Faces Critical Deserialization Flaw in Versions Through 1.21.0

Threat TimesOct 10, 2026

The National Vulnerability Database rates the untrusted data deserialization issue in ThemeREX Hygia as critical with a CVSS score of 9.8.

Vulnerabilities

Critical Deserialization Flaw in Axiomthemes Balance Plugin Exposes Sites to Object Injection

Threat TimesOct 10, 2026

The National Vulnerability Database rates CVE-2026-93945 as critical, affecting Axiomthemes Balance versions up to 1.12.0 through untrusted data deserialization.