New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Progress WS_FTP Server: Improper authentication with credential exposure

The flaw affects Progress Software WS_FTP Server on Windows in versions before 2024.0.6 and 2025.0.3. An unauthenticated remote attacker can access sensitive information, including administrative credentials, without user interaction. The CVSS 10.0 score reflects high impact on confidentiality, integrity and availability, with a changed scope. A compromised server could serve as a starting point for attacks on the wider network.

Progress Software · WS_FTP Server

Research and translation in progress – available shortly.

Langflow Langflow

Research and translation in progress – available shortly.

Langflow Langflow

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Zoho Flow WordPress plugin: Unauthenticated PHP Object Injection

The Zoho Flow plugin for WordPress up to version 2.14.5 contains a PHP Object Injection vulnerability (CWE-502) that can be triggered without authentication over the network. An attacker who sends crafted serialized data to the affected site may manipulate how the site processes data, which can lead to harmful actions on the server, depending on the PHP classes available on the site. No official patch was confirmed at the time of research, and the fixed version is unknown.

Zoho · Flow WordPress plugin

Gunslinger WordPress theme: PHP Object Injection without authentication

The Gunslinger WordPress theme up to and including version 1.11 is affected by an unauthenticated PHP Object Injection flaw (CWE-502) rated CVSS 9.8 critical. An unauthenticated remote attacker can supply crafted serialized data to the website, which may lead to code execution or manipulation of data on the server, depending on the classes available in installed plugins. The theme is typically used for online shops, so internet-facing sites are most at risk.

ThemeREX · Gunslinger

Good Homes WordPress theme: PHP Object Injection without authentication

The Good Homes WordPress theme up to version 1.3.13 is vulnerable to PHP Object Injection through unsafe deserialization of data. An unauthenticated remote attacker can exploit this over the network by sending crafted input to a public website. Depending on the PHP classes available on the site, this can lead to manipulation of data or code execution on the server.

ThemeREX · Good Homes

Gamic WordPress Theme: Unauthenticated PHP Object Injection

The Gamic WordPress theme up to version 1.19 is vulnerable to PHP Object Injection (CWE-502), which can be triggered without authentication over the network. An attacker can manipulate how the site processes serialized data, which may allow harmful actions on the server. Whether this leads to code execution or data compromise depends on other installed plugins or themes that provide exploitable gadget chains; this is not established for the theme alone.

ThemeREX · Gamic WordPress Theme

Gamezone WordPress theme: Unauthenticated PHP Object Injection

The Gamezone WordPress theme by ThemeREX, up to and including version 1.1.11, contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted data to the website without logging in, which can lead to harmful actions on the server, such as code execution, depending on the gadget classes available in the installation. At the time of writing, no fixed version or vendor advisory has been found, and the NVD status is Deferred.

ThemeREX · Gamezone WordPress theme

ThemeREX EmojiNation theme: PHP Object Injection without authentication

The WordPress theme EmojiNation up to and including version 1.0.12 contains a PHP Object Injection vulnerability (CWE-502). It can be triggered over the network without authentication. An attacker can manipulate how the site processes data, which may lead to harmful actions on the server. No fixed version has been confirmed, and NVD lists the status as Deferred.

ThemeREX · EmojiNation theme

Edge Decor WordPress theme: Unauthenticated PHP Object Injection

The Edge Decor WordPress theme up to and including version 2.9 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). A remote attacker can send crafted serialized data to a vulnerable site without logging in, which can be used to manipulate server-side processing. Whether this leads to code execution depends on the gadget chains available in the theme and other installed plugins.

ThemeREX · Edge Decor

Coinpress WordPress theme: Unauthenticated PHP Object Injection

The Coinpress WordPress theme up to and including version 1.0.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who can send crafted input to the affected site may manipulate how data is processed and potentially run harmful actions on the server. The NVD rates this CVSS 3.1 9.8 (Critical), while the VulDB score is 7.3 and Vulners lists 5.9, so the scores differ; plan using the higher value until the Patchstack advisory says otherwise.

ThemeREX · Coinpress

Bonbon WordPress theme: Unauthenticated PHP Object Injection

The WordPress theme Bonbon up to and including version 1.11 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker can send crafted input to a public website without logging in, which can lead to manipulation of server-side processing and potentially to remote code execution. No official fix is known and no confirmed exploitation has been reported so far.

ThemeREX · Bonbon

Avventure WordPress theme: Unauthenticated PHP Object Injection

The Avventure WordPress theme up to and including version 1.1.12 contains a PHP Object Injection vulnerability (CVE-2026-62010, CVSS 9.8 critical). An unauthenticated remote attacker can supply crafted serialized data to the site, which may lead to code execution, SQL injection, path traversal or denial of service, depending on the available gadget chains. The exposure applies to any internet-reachable WordPress site running the theme. No fixed version or vendor advisory was available at the time of research.

ThemeREX · Avventure

Filmax WordPress theme: PHP Object Injection vulnerability

The Filmax WordPress theme up to and including version 1.1.11 contains a PHP Object Injection vulnerability (CWE-502) that can be exploited without authentication. An remote attacker can send crafted input to manipulate how the site processes serialized data, which may lead to harmful actions on the server. Whether this allows code execution depends on whether a usable gadget chain exists in the installed WordPress environment.

ThemeREX · Filmax

ThemeREX Orpheus: PHP Object Injection by unauthenticated users

The WordPress theme Orpheus up to and including version 1.8 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker on the network can send crafted data to the site without any account, which may allow manipulation of server-side processing and harmful actions on the server. NVD rates the issue as Critical (CVSS 3.1 9.8), while VulDB assigns 7.3; no vendor fix has been confirmed.

ThemeREX · Orpheus

ThemeREX Nuts theme: PHP Object Injection without authentication

The Nuts WordPress theme up to and including version 1.12 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who sends a crafted request can manipulate how the site processes data, which may lead to harmful actions on the server, including reading or changing data and disrupting the site. The theme is sold for gambling and casino websites; the vendor has not published a fix, and the vendor-to-product match is based on third-party data.

ThemeREX · Nuts

Muzicon WordPress theme: Unauthenticated PHP Object Injection

The Muzicon WordPress theme up to and including version 1.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who sends crafted serialized data to a vulnerable site may be able to manipulate how the application processes data and run harmful actions on the server. The actual impact depends on the gadget chains available in the installed plugins, which has not been assessed.

ThemeREX · Muzicon

Motorix WordPress theme: PHP Object Injection without authentication

The Motorix WordPress theme up to and including version 1.11 contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted serialized data over the network without logging in, which may let them manipulate how the site processes data and run harmful actions on the server. Remote code execution is reported by a third-party aggregator but is not confirmed by the primary advisory, and whether it is exploitable depends on the code installed on each site.

ThemeREX · Motorix

ThemeREX Mission WordPress theme: PHP Object Injection

The Mission WordPress theme up to version 1.22 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted data that the application unserializes, which can manipulate application logic and, depending on gadget chains available on the server, lead to code execution. Patchstack rates it CVSS 9.8 and high priority. Public websites are reachable from the internet by design, so exposure is high.

ThemeREX · Mission

Meals & Wheels WordPress theme: PHP Object Injection without authentication

The Meals & Wheels WordPress theme up to and including version 1.1.13 contains a PHP Object Injection weakness (CWE-502). An unauthenticated remote attacker can submit crafted serialized data, which may allow manipulation of how the site processes data and execution of harmful actions on the server. The CVSS score of 9.8 is a CNA score, as NVD enrichment is pending.

ThemeREX · Meals & Wheels

Marcell WordPress theme: Unauthenticated PHP Object Injection

The Marcell WordPress theme up to and including version 1.2.14 is affected by an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted data to the site, which may let them manipulate how the site processes data and potentially run harmful actions on the server. NVD rates the issue 9.8 (Critical), while VulDB rates it 7.3. No vendor patch has been confirmed, and no public exploit or known in-the-wild use was found.

ThemeREX · Marcell