CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (1,721)

page 8 of 87

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-22454	Oracle Corporation Solaris	Cri	0.64	9.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
CVE-2026-22453	Themerex Pets Club	Cri	0.64	9.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
CVE-2026-22451	Ancorathemes Handyman	Cri	0.64	9.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.
CVE-2026-22417	Themegoods Grand Wedding	Cri	0.64	9.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
CVE-2025-54001	Themerex Classter	Cri	0.64	9.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
CVE-2026-22384	leafcolor Applay - Shortcodes	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.
CVE-2025-69405	Themerex Lorem Ipsum \| Books & Media Store	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum \| Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum \| Books & Media Store: from n/a through <= 1.2.11.
CVE-2025-69404	Themerex Extreme Store	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.
CVE-2025-69382	Themesflat Themesflat Addons For Elementor	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.
CVE-2025-69372	Ancorathemes SevenHills	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.
CVE-2025-69371	—	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.
CVE-2025-69370	Themegoods Capella	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
CVE-2025-69329	Zyxel Prestige	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.
CVE-2025-69301	Themegoods PhotoMe	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
CVE-2025-68541	Bold Themes Ippsum	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.
CVE-2025-67997	Bold Themes Travelicious	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.
CVE-2025-67996	Bold Themes Nestin	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.
CVE-2025-67995	LoftOcean PatioTime	Cri	0.64	9.8	0.01	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.
CVE-2026-23549	WordPress Wpevently	Cri	0.64	9.8	0.00	Feb 19, 2026	Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
CVE-2026-23542	Themegoods Grand Restaurant	Cri	0.64	9.8	0.00	Feb 19, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

CVE-2026-22454CriMar 5, 2026
Oracle Corporation
Solaris
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
CVE-2026-22453CriMar 5, 2026
Themerex
Pets Club
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
CVE-2026-22451CriMar 5, 2026
Ancorathemes
Handyman
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.
CVE-2026-22417CriMar 5, 2026
Themegoods
Grand Wedding
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
CVE-2025-54001CriMar 5, 2026
Themerex
Classter
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
CVE-2026-22384CriFeb 20, 2026
leafcolor
Applay - Shortcodes
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.
CVE-2025-69405CriFeb 20, 2026
Themerex
Lorem Ipsum | Books & Media Store
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.
CVE-2025-69404CriFeb 20, 2026
Themerex
Extreme Store
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.
CVE-2025-69382CriFeb 20, 2026
Themesflat
Themesflat Addons For Elementor
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.
CVE-2025-69372CriFeb 20, 2026
Ancorathemes
SevenHills
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.
CVE-2025-69371CriFeb 20, 2026
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.
CVE-2025-69370CriFeb 20, 2026
Themegoods
Capella
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
CVE-2025-69329CriFeb 20, 2026
Zyxel
Prestige
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.
CVE-2025-69301CriFeb 20, 2026
Themegoods
PhotoMe
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
CVE-2025-68541CriFeb 20, 2026
Bold Themes
Ippsum
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.
CVE-2025-67997CriFeb 20, 2026
Bold Themes
Travelicious
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.
CVE-2025-67996CriFeb 20, 2026
Bold Themes
Nestin
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.
CVE-2025-67995CriFeb 20, 2026
LoftOcean
PatioTime
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.
CVE-2026-23549CriFeb 19, 2026
WordPress
Wpevently
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
CVE-2026-23542CriFeb 19, 2026
Themegoods
Grand Restaurant
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.