CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,104)

page 17 of 156

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-27083	WordPress Work & Travel Company	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
CVE-2026-27082	WordPress Love Story	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
CVE-2026-25429	WordPress Nexa Blocks	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
CVE-2026-25032	WordPress Ricky	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
CVE-2026-25031	WordPress Tasty Daily	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
CVE-2026-25030	WordPress Goldish	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
CVE-2026-25029	WordPress KIDZ	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
CVE-2026-24989	WordPress SUMO Affiliates Pro	Cri	0.64	9.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
CVE-2026-24378	WordPress Eventprime	Cri	0.64	9.8	0.01	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
CVE-2026-22507	WordPress Beelove	Cri	0.64	9.8	0.01	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.
CVE-2026-22500	WordPress m2 \| Construction and Tools Store	Cri	0.64	9.8	0.01	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in axiomthemes m2 \| Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 \| Construction and Tools Store: from n/a through <= 1.1.2.
CVE-2025-60237	WordPress Finag	Cri	0.64	9.8	0.01	Mar 19, 2026	Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
CVE-2025-60233	WordPress Zuut	Cri	0.64	9.8	0.00	Mar 19, 2026	Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
CVE-2026-25873	VectorSpaceLab OmniGen2-RL	Cri	0.64	9.8	0.01	Mar 18, 2026	OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies…
CVE-2026-25449	WordPress Traveler	Cri	0.64	9.8	0.00	Mar 18, 2026	Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVE-2025-56422	Limesurvey Limesurvey	Cri	0.64	9.8	0.01	Mar 10, 2026	A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
CVE-2026-28105	WordPress Good Energy	Cri	0.64	9.8	0.00	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
CVE-2026-28074	WordPress Pizza House	Cri	0.64	9.8	0.00	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
CVE-2026-27439	WordPress Dentario	Cri	0.64	9.8	0.00	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
CVE-2026-27438	WordPress Kingler	Cri	0.64	9.8	0.00	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.

CVE-2026-27083CriMar 25, 2026
WordPress
Work & Travel Company
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
CVE-2026-27082CriMar 25, 2026
WordPress
Love Story
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
CVE-2026-25429CriMar 25, 2026
WordPress
Nexa Blocks
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
CVE-2026-25032CriMar 25, 2026
WordPress
Ricky
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
CVE-2026-25031CriMar 25, 2026
WordPress
Tasty Daily
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
CVE-2026-25030CriMar 25, 2026
WordPress
Goldish
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
CVE-2026-25029CriMar 25, 2026
WordPress
KIDZ
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
CVE-2026-24989CriMar 25, 2026
WordPress
SUMO Affiliates Pro
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
CVE-2026-24378CriMar 25, 2026
WordPress
Eventprime
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
CVE-2026-22507CriMar 25, 2026
WordPress
Beelove
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.
CVE-2026-22500CriMar 25, 2026
WordPress
m2 | Construction and Tools Store
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
CVE-2025-60237CriMar 19, 2026
WordPress
Finag
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
CVE-2025-60233CriMar 19, 2026
WordPress
Zuut
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
CVE-2026-25873CriMar 18, 2026
VectorSpaceLab
OmniGen2-RL
risk 0.64cvss 9.8epss 0.01
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies…
CVE-2026-25449CriMar 18, 2026
WordPress
Traveler
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVE-2025-56422CriMar 10, 2026
Limesurvey
Limesurvey
risk 0.64cvss 9.8epss 0.01
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
CVE-2026-28105CriMar 5, 2026
WordPress
Good Energy
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
CVE-2026-28074CriMar 5, 2026
WordPress
Pizza House
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
CVE-2026-27439CriMar 5, 2026
WordPress
Dentario
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
CVE-2026-27438CriMar 5, 2026
WordPress
Kingler
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.