CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Deserialization of Untrusted Data vulnerability in the Greeny theme by ThemeREX Group allows Object Injection. This issue affects Greeny from n/a through 2.10.0.
Deserialization of Untrusted Data vulnerability in the Hogwords theme by ThemeREX Group allows Object Injection. This issue affects Hogwords from n/a through 1.2.7.
Deserialization of Untrusted Data vulnerability in the Hygia theme by ThemeREX Group allows Object Injection. This issue affects Hygia from n/a through 1.21.0.
Deserialization of Untrusted Data vulnerability in the IPharm theme by ThemeREX Group allows Object Injection. This issue affects IPharm from n/a through 1.2.4.
Deserialization of Untrusted Data vulnerability in the Let's Play theme by ThemeREX Group allows Object Injection. This issue affects Let's Play from n/a through 1.1.15.
The Partiso WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.1.13.
The Rosalinda WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.2.4.
The Smart Casa WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.0.12.
The Smash WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.12.0.
The Tantra WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.9.0.
The Travesia WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.1.16.
The Veto WordPress theme by Axiomthemes contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.6.0.
The Gutentype WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.1.12.
The Booklovers WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.13.0.
The WPCOM Member plugin for WordPress (versions up to and including 1.7.27) contains an authentication bypass in its social-login callback handler. Missing nonce validation, OAuth state verification, and per-visitor session namespace isolation allow an unauthenticated attacker to inject a forged session entry and log in as any WordPress user, including administrators, if their bound openid/unionid is known.
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to and including 34.0.10. Unauthenticated attackers can delete arbitrary files on the server, potentially leading to remote code execution, and relocated files are publicly accessible in the wp-content/uploads/ppom_files/confirmed/ directory.
The Avada (Fusion) Builder plugin for WordPress up to version 7.16.1 contains an authorization bypass vulnerability. An unauthenticated attacker can invoke arbitrary WordPress action hooks by sending a crafted request to the public form-submit endpoint, potentially leading to permanent deletion of content (posts, pages, comments) or other state changes.
The 3D Product configurator plugin for WooCommerce up to version 2.16.2 is vulnerable to Remote Code Execution via the 'xpv_image' parameter. Missing authentication and nonce checks on the wp_loaded handler, combined with lack of sanitization before echoing into a Dompdf-rendered HTML template with PHP execution enabled, allow unauthenticated attackers to execute code on the server.
The Extensions For CF7 plugin up to version 3.4.5 is vulnerable to Arbitrary File Upload via the extcf7_submit function. Missing file extension, MIME type, and size validation, combined with absence of PHP-execution guards and a sanitize_file_name() bypass, allow unauthenticated attackers to upload executable files, leading to remote code execution.
The Blocksy Companion plugin up to version 2.1.58 is vulnerable to privilege escalation. The implement_user_registration() AJAX handler disables Dokan's vendor-registration nonce check and trusts an attacker-supplied $_POST['role'] value, allowing unauthenticated attackers to obtain a Dokan 'seller' account and be auto-authenticated, even when vendor signup is disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS