Samedi 10 octobre 2026

ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

ThemeRex Photolia

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

AncoraThemes Qwery

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

ThemeREX Jacqueline

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

ThemeREX Alliance

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

axiomthemes Kicker

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

axiomthemes Original

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

AncoraThemes Anesta

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

axiomthemes FC United

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

ThemeREX ShiftCV

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

ThemeREX Windsor

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

ThemeREX Education Center

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

AncoraThemes Drone Media

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

ThemeREX Asia Garden

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

ThemeREX N7 | Golf Club Sports & Events

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

ThemeREX Invetex

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

ThemeREX Law Office

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

ThemeREX WineShop

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

ThemeREX Equadio

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

ThemeREX Juno

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

BoldThemes Avala

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

The4 Kalles

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

ThemeREX Yacht Rental

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

ThemeREX Wine House

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

ThemeREX Tipsy

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

ThemeREX Stargaze

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

ThemeREX Splendour

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

AncoraThemes CleanSkin

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Sarah Giles Dynamic User Directory

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Pluggabl Booster for WooCommerce

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Payever - WooCommerce Gateway

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

themeisle PPOM – Product Addons & Custom Fields for WooCommerce

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.

expivi 3D Product configurator for WooCommerce

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.

htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.