CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,104)

page 25 of 156

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-39500	WordPress Goodlayers Hostel	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.
CVE-2025-39499	WordPress Medicare	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.
CVE-2025-39495	WordPress Avantage	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.
CVE-2025-39485	Themegoods Grand Tour	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.
CVE-2025-39480	WordPress Cardealer	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.
CVE-2025-32292	WordPress Jarvis	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.
CVE-2025-31927	WordPress Acerola	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.
CVE-2025-31631	WordPress Fish House	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.
CVE-2025-31430	WordPress The Business	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.
CVE-2025-31423	WordPress Umberto	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8.
CVE-2025-31069	WordPress HotStar – Multi-Purpose Business Theme	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
CVE-2025-31049	WordPress Dash	Cri	0.64	9.8	0.01	May 23, 2025	Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
CVE-2025-39356	WordPress Foodbakery Sticky Cart	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
CVE-2025-39354	Themegoods Grand Conference	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.
CVE-2025-39349	Potenzaglobalsolutions Ciyashop	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a through <= 4.18.0.
CVE-2025-39348	Themegoods Grand Restaurant	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.
CVE-2025-32928	Themegoods Altair	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.
CVE-2025-32927	Chimpgroup Foodbakery	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through <= 3.3.
CVE-2025-47581	WordPress Events Calendar Registration & Tickets	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
CVE-2025-39410	WordPress Smart Sections Theme Builder - WPBakery Page Builder Addon	Cri	0.64	9.8	0.00	May 19, 2025	Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8.

CVE-2025-39500CriMay 23, 2025
WordPress
Goodlayers Hostel
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.
CVE-2025-39499CriMay 23, 2025
WordPress
Medicare
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.
CVE-2025-39495CriMay 23, 2025
WordPress
Avantage
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.
CVE-2025-39485CriMay 23, 2025
Themegoods
Grand Tour
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.
CVE-2025-39480CriMay 23, 2025
WordPress
Cardealer
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.
CVE-2025-32292CriMay 23, 2025
WordPress
Jarvis
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.
CVE-2025-31927CriMay 23, 2025
WordPress
Acerola
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.
CVE-2025-31631CriMay 23, 2025
WordPress
Fish House
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.
CVE-2025-31430CriMay 23, 2025
WordPress
The Business
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.
CVE-2025-31423CriMay 23, 2025
WordPress
Umberto
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8.
CVE-2025-31069CriMay 23, 2025
WordPress
HotStar – Multi-Purpose Business Theme
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
CVE-2025-31049CriMay 23, 2025
WordPress
Dash
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
CVE-2025-39356CriMay 19, 2025
WordPress
Foodbakery Sticky Cart
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
CVE-2025-39354CriMay 19, 2025
Themegoods
Grand Conference
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.
CVE-2025-39349CriMay 19, 2025
Potenzaglobalsolutions
Ciyashop
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a through <= 4.18.0.
CVE-2025-39348CriMay 19, 2025
Themegoods
Grand Restaurant
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.
CVE-2025-32928CriMay 19, 2025
Themegoods
Altair
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.
CVE-2025-32927CriMay 19, 2025
Chimpgroup
Foodbakery
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through <= 3.3.
CVE-2025-47581CriMay 19, 2025
WordPress
Events Calendar Registration & Tickets
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
CVE-2025-39410CriMay 19, 2025
WordPress
Smart Sections Theme Builder - WPBakery Page Builder Addon
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8.