Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Stargaze WordPress Theme
The National Vulnerability Database lists CVE-2026-62051 as a critical flaw in Stargaze versions up to 1.10, allowing remote code execution.
ThemeREX
Everything Threat Times has reported about ThemeREX: 12 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Splendour WordPress Theme
The National Vulnerability Database lists CVE-2026-62050 as a critical flaw allowing remote code execution in Splendour versions up to 1.23.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in Tipsy Theme
The National Vulnerability Database rates CVE-2026-62052 as critical for Tipsy versions 1.6 and earlier due to unauthenticated injection risks.
Vulnerabilities
Critical PHP Object Injection Flaw Found in Wine House WordPress Theme
Unauthenticated attackers can exploit CVE-2026-62053 in Wine House versions up to 3.20 to achieve critical remote code execution.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Yacht Rental WordPress Theme
The National Vulnerability Database lists CVE-2026-62054 as a critical flaw allowing remote code execution in Yacht Rental versions up to 2.6.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Juno WordPress Theme
A severe vulnerability in the Juno WordPress theme allows attackers to execute code without authentication, affecting versions up to 2.25.
Vulnerabilities
Equadio WordPress Theme Faces Critical Unauthenticated PHP Object Injection Flaw
The National Vulnerability Database rates CVE-2026-62087 as critical, affecting Equadio versions up to 1.1.4 with a CVSS score of 9.8.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in WineShop <= 3.20
The NVD rates CVE-2026-62090 as critical, affecting WineShop versions up to 3.20 with a CVSS score of 9.8 due to unauthenticated PHP object injection vulnerabilities.
Vulnerabilities
ThemeREX Smash Plugin Faces Critical Deserialization Flaw in Versions Up to 1.12.0
The National Vulnerability Database lists CVE-2026-93931 as critical, exposing users of older Smash plugin versions to remote object injection risks.
Vulnerabilities
Critical Deserialization Flaw in ThemeREX IPharm Plugin Rated 9.8
A severe object injection vulnerability in the IPharm WordPress plugin affects versions up to 1.2.4, allowing attackers to execute arbitrary code on affected sites.
Vulnerabilities
Critical object injection flaw found in ThemeREX Hogwords plugin
A CVSS 9.8 vulnerability in ThemeREX Hogwords allows untrusted data deserialization, affecting versions up to 1.2.7.
Vulnerabilities
Critical Object Injection Flaw Found in ThemeREX Convex Plugin
The National Vulnerability Database lists a CVSS 9.8 critical deserialization issue in ThemeREX Convex versions up to 1.16.0.