Vulnerabilities
VillaTheme AFFI Plugin Has Critical Object Injection Vulnerability
A CVSS 9.8 flaw in VillaTheme AFFI – Affiliate Marketing for WooCommerce allows object injection through untrusted data deserialization.
object injection
Everything Threat Times has reported about object injection: 10 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Critical Object Injection Vulnerability Found in Smart Casa Versions Up to 1.0.12
The National Vulnerability Database rates CVE-2026-93932 as critical with a CVSS score of 9.8, affecting ThemeREX Group’s Smart Casa software through version 1.0.12 due to unsafe data deserialization.
Vulnerabilities
Critical Deserialization Flaw Found in ThemeREX Edema Plugin Versions Up to 1.2.2.2
A severe object injection vulnerability in ThemeREX Group Edema allows untrusted data deserialization, posing a high risk to affected installations.
Vulnerabilities
Critical object injection flaw found in ThemeREX Hogwords plugin
A CVSS 9.8 vulnerability in ThemeREX Hogwords allows untrusted data deserialization, affecting versions up to 1.2.7.
Vulnerabilities
Hygia Plugin Faces Critical Deserialization Flaw in Versions Through 1.21.0
The National Vulnerability Database rates the untrusted data deserialization issue in ThemeREX Hygia as critical with a CVSS score of 9.8.
Vulnerabilities
Critical Deserialization Flaw in Axiomthemes Balance Plugin Exposes Sites to Object Injection
The National Vulnerability Database rates CVE-2026-93945 as critical, affecting Axiomthemes Balance versions up to 1.12.0 through untrusted data deserialization.
Vulnerabilities
Critical Object Injection Flaw Found in ThemeREX Convex Plugin
The National Vulnerability Database lists a CVSS 9.8 critical deserialization issue in ThemeREX Convex versions up to 1.16.0.
Vulnerabilities
Critical CVE-2026-93942 Allows Object Injection in ThemeREX Dwell Up to Version 1.16.0
The National Vulnerability Database lists a critical deserialization flaw in ThemeREX Dwell, affecting versions through 1.16.0 with a CVSS score of 9.8.
Vulnerabilities
Critical CVE-2026-62046 Object Injection Flaw Found in ThemeREX Gutentype Plugin
A CVSS 9.8 critical vulnerability in ThemeREX Group Gutentype allows object injection via untrusted data deserialization in versions up to 2.1.12.
Vulnerabilities
Warning Signs of Insecure Deserialization in Web Applications
Insecure deserialization often manifests as subtle state anomalies or unexpected object behaviors rather than immediate crashes, hiding critical access control failures within routine data processing.