Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.2	CVE-2026-114704	Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. Christoph Vielgrader, PatchstackChristoph Vielgrader Relevanssi, Patchstack Relevanssi	NVD	Oct 24 14:16 UTC
CVE-2026-114704Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. Executive summary A deserialization flaw in the Relevanssi WordPress plugin, versions through 4.28.4, lets attackers inject PHP objects. Patchstack rates it as medium priority with a CVSS severity of 7.2 and says it is expected to be exploited. The vendor-side recommendation is to update the plugin to version 4.28.5 or later. Technical summary The weakness is classified as PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The advisory states the required privilege is Editor, so an attacker needs an account with that role. Affected versions are listed as n/a through 4.28.4 by NVD and as 4.28.4 and earlier by Patchstack, and the patched version is 4.28.5. Patchstack has issued a mitigation rule that blocks attacks until the update is applied. The advisory does not state a workaround beyond the mitigation rule, and it does not give specific detection guidance or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects Christoph Vielgrader Patchstack Christoph Vielgrader Relevanssi Patchstack Relevanssi NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	High	7.1	CVE-2026-114697	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue... QuarkA, PatchstackQuarkA QA Analytics, Patchstack QA Analytics	NVD	Oct 24 08:16 UTC
CVE-2026-114697Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue... Executive summary A cross-site scripting flaw in the QA Analytics WordPress plugin, versions 5.3.0.1 and earlier, lets attackers inject malicious scripts into affected websites. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The recommended action is to update the plugin to version 5.3.0.2 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability, classified under OWASP A3: Injection, in the QA Analytics plugin for WordPress. The advisory states that vulnerable versions are 5.3.0.1 and earlier and that the patched version is 5.3.0.2. Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form, while the attacker needs no authentication. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, but the advisory does not describe other workarounds. Detection guidance beyond the mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects QuarkA Patchstack QuarkA QA Analytics Patchstack QA Analytics NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114694	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... Pixelite, PatchstackPixelite Events Manager	NVD	Oct 24 08:16 UTC
CVE-2026-114694Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... Executive summary A cross-site scripting flaw affects the Events Manager WordPress plugin up to version 7.4.8. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited, and it recommends updating the plugin to version 7.4.9 or later. Technical summary The flaw is a reflected cross-site scripting (XSS) issue classified under OWASP A3: Injection, which lets injected scripts run in a visitor's browser. The advisory lists the required privilege as unauthenticated but says exploitation requires a privileged user to take an action such as clicking a malicious link or visiting a crafted page. Vulnerable versions are stated as 7.4.8 and earlier, and the patched version is 7.4.9. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any further workarounds or specific detection guidance beyond updating and the mitigation rule. It does not state whether exploitation in the wild has been confirmed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Pixelite Patchstack Pixelite Events Manager NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114693	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows... Plugins360 Labs, PatchstackPlugins360 Labs All-in-One Video Gallery, Patchstack All-in-One Video Gallery	NVD	Oct 24 08:16 UTC
CVE-2026-114693Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows... Executive summary A cross-site scripting flaw affects the WordPress All-in-One Video Gallery plugin, versions 4.9.7 and earlier. The publisher Patchstack rates it medium priority with a CVSS score of 6.5. The recommended action is to update the plugin to version 5.0.0 or later. Technical summary The advisory classifies this as cross-site scripting (XSS), which Patchstack maps to OWASP A3: Injection. Exploitation requires a privileged user, with the required privilege listed as Subscriber, to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are 4.9.7 and earlier, and the patched version is 5.0.0. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, and it states that the vulnerability is expected to become exploited. The advisory does not state any detection indicators or additional workarounds beyond the update and mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects Plugins360 Labs Patchstack Plugins360 Labs All-in-One Video Gallery Patchstack All-in-One Video Gallery NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.8	CVE-2026-114196	Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. paytiumsupport, Patchstackpaytiumsupport Paytium	NVD	Oct 24 08:16 UTC
CVE-2026-114196Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. Executive summary A deserialization flaw in the Paytium WordPress plugin, versions up to and including 5.0.5, lets unauthenticated attackers inject PHP objects. The advisory rates it critical at CVSS 9.8 and says it is expected to be exploited in mass campaigns. The vendor recommends updating the plugin to version 5.0.6 or later. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3: Injection. The advisory states the attack requires no privileges (unauthenticated) and gives a CVSS score of 9.8. Affected versions are stated as n/a through 5.0.5 and <= 5.0.5, with the patched version 5.0.6. The advisory says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated, but it does not describe a manual workaround, the specific vulnerable code path, or indicators of compromise and detection guidance. Whether exploitation in the wild has been observed is not stated beyond the expectation that it will be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects paytiumsupport Patchstack paytiumsupport Paytium NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-112869	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue... Noah Hearle, PatchstackNoah Hearle We’re Open!, Patchstack We're Open!	NVD	Oct 24 08:16 UTC
CVE-2026-112869Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue... Executive summary A cross-site scripting flaw affects the We're Open! opening-hours plugin for WordPress, versions 2.6 and earlier. The advisory rates it as medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor recommends updating the plugin to version 2.7 or later. Technical summary This is a reflected cross-site scripting (XSS) vulnerability classed as OWASP A3: Injection. The advisory states that it can be started by an unauthenticated user, but a privileged user must take an action such as clicking a malicious link or submitting a form for exploitation to succeed. Vulnerable versions are listed as 2.6 and earlier, and the patched version is 2.7. The advisory recommends updating to 2.7 or later and notes that Patchstack has issued a mitigation rule that blocks attacks until the update is applied. It does not state a manual workaround beyond that, nor does it state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Noah Hearle Patchstack Noah Hearle We’re Open!Patchstack We're Open! NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.3	CVE-2026-111402	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... Tribulant Software, PatchstackTribulant Software Newsletters	NVD	Oct 24 08:16 UTC
CVE-2026-111402Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... Executive summary A SQL injection flaw affects the Newsletters plugin for WordPress, made by Tribulant Software, in versions 4.18.1 and earlier. The publisher rates it 9.3 on CVSS and says it is highly dangerous and likely to be used in mass-exploit campaigns, so the advisory recommends updating the plugin to version 4.18.2 or later right away. Technical summary This is an SQL injection vulnerability (OWASP A3: Injection) in the Newsletters WordPress plugin, versions 4.18.1 and earlier, with a CVSS severity of 9.3 and a Patchstack priority of High. The advisory states that it can be exploited by an unauthenticated attacker, and that successful exploitation could let an attacker read, modify, or delete the entire database, including user accounts and private data. The patched version is 4.18.2, and the advisory says to update to 4.18.2 or later. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any other workarounds, and it does not give specific detection guidance or indicate whether exploitation has been observed in the wild beyond saying it is expected to become exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects Tribulant Software Patchstack Tribulant Software Newsletters NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-112863	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS:... Hogash, PatchstackHogash KALLYAS	NVD	Oct 23 13:17 UTC
CVE-2026-112863Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS:... Executive summary A cross-site scripting flaw affects the KALLYAS WordPress theme, versions 4.25.0 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. No official patch is stated as available, and the vendor's recommended immediate action is to update the theme, or ask a hosting provider or developer for help if that is not possible. Technical summary This is a reflected cross-site scripting (XSS) vulnerability classified under OWASP A3: Injection, in the KALLYAS theme by developer Hogash. The advisory states that the required privilege is unauthenticated, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page, so user interaction is needed. Affected versions are stated as <= 4.25.0. No patched version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule to block attacks until an official patch is available, and the advisory recommends mitigating or resolving the issue immediately. Detailed workarounds beyond the Patchstack rule, and specific detection guidance, are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Hogash Patchstack Hogash KALLYAS NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112858	Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. Axiomthemes, PatchstackAxiomthemes Rhodos	NVD	Oct 23 13:17 UTC
CVE-2026-112858Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. Executive summary A deserialization flaw in the Rhodos WordPress theme, published by axiomthemes, affects versions up to and including 1.3.3. The advisory rates it 9.8 (critical) and says it is expected to be exploited, and it notes that no official patch is available yet. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, which Patchstack classifies under OWASP A3 Injection. The advisory states that it can be exploited without authentication (required privilege: Unauthenticated), and the CVSS severity is listed as 9.8. Vulnerable versions are stated as <= 1.3.3, and the NVD entry says "from n/a through 1.3.3". No patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available. The advisory advises updating the theme once a fix exists, and asking a hosting provider or developer for help if that is not possible. No specific detection indicators, exploit details, or fixed version are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Rhodos NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112857	Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. Axiomthemes, PatchstackAxiomthemes Reprizo	NVD	Oct 23 13:17 UTC
CVE-2026-112857Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. Executive summary A deserialization flaw in the Reprizo WordPress theme, affecting versions through 1.0.8, lets unauthenticated attackers run harmful code on affected websites. Patchstack rates it high priority with a CVSS score of 9.8 and expects it to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme when a fix exists or asking a hosting provider or developer for help in the meantime. Technical summary The weakness is PHP Object Injection, classified under deserialization of untrusted data (OWASP A3: Injection). The advisory states that it requires no authentication, and it gives a CVSS severity of 9.8. Affected versions are listed as from n/a through 1.0.8 and as <= 1.0.8. The advisory states that no official patched version is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released. The advisory does not state a specific workaround beyond that rule, and it does not describe the exact vulnerable code path or payload format. Detection guidance beyond the Patchstack mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Reprizo NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112856	Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. ThemeREX Group, PatchstackThemeREX Group Vagabonds	NVD	Oct 23 13:17 UTC
CVE-2026-112856Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. Executive summary A deserialization flaw in the Vagabonds WordPress theme by ThemeREX Group affects versions up to and including 1.3.10. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited in mass campaigns. The advisory says no official patch is available, and the recommended immediate action is to mitigate or update the theme, or ask a hosting provider or web developer for help. Technical summary The flaw is PHP Object Injection, caused by deserialization of untrusted data, and is classed under OWASP A3: Injection. The advisory says it requires no authentication (unauthenticated access) and gives a CVSS 9.8 severity. The affected versions are listed as from n/a through 1.3.10, and the advisory states no official patched version is available. Patchstack has issued a mitigation rule to block attacks, but the advisory does not describe its details or any manual workaround. Specific exploit mechanics, vulnerable code paths, and detection indicators are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group Vagabonds NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112853	Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. Axiomthemes, PatchstackAxiomthemes Hallelujah	NVD	Oct 23 13:17 UTC
CVE-2026-112853Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. Executive summary A deserialization flaw in the Hallelujah WordPress theme by axiomthemes affects versions up to and including 1.1.1. The advisory rates it critical at CVSS 9.8, notes it can be exploited without logging in, and says mass-exploit campaigns are likely. The advisory states no official patch is available, and it recommends updating the theme if a fix exists or using Patchstack's mitigation rule until one does. Technical summary The flaw is PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The required privilege is unauthenticated, and the advisory does not describe the specific request or parameter used to reach the flaw. The affected versions are listed as from n/a through 1.1.1, and the advisory gives no fixed version because the patched version is not stated and no official patch is available. No workaround beyond the Patchstack mitigation rule is described, and no detection guidance, indicators of compromise, or exploitation-in-the-wild confirmation is given. The advisory does not state a CVSS vector string, only a score of 9.8. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Hallelujah NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112851	Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. ThemeREX Group, PatchstackThemeREX Group HotLock	NVD	Oct 23 13:17 UTC
CVE-2026-112851Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. Executive summary A deserialization flaw in the HotLock WordPress theme by ThemeREX Group affects versions up to and including 1.3.9. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited, so it could let an unauthenticated attacker take control of affected websites. No official patch is stated as available, so the advisory recommends mitigating the issue immediately, such as with the Patchstack mitigation rule. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states that required privilege is unauthenticated, and that an attacker can manipulate how the site processes data to run harmful actions on the server. Affected versions are stated as from n/a through 1.3.9 and <= 1.3.9. No official patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule to block attacks, and the advisory recommends updating the affected theme if possible, or asking a hosting provider or developer for help. No specific detection guidance, exploitation evidence beyond the expectation of exploitation, or other workarounds are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group HotLock NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112848	Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. AivahThemes, PatchstackAivahThemes Hostme v2	NVD	Oct 23 13:17 UTC
CVE-2026-112848Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. Executive summary A deserialization flaw in the Hostme v2 WordPress theme from AivahThemes allows attackers to inject objects into the site. Patchstack rates it high priority with a CVSS score of 9.8, and it says the flaw is likely to be exploited in mass attacks. No official patch is stated as available, and the advisory recommends updating or mitigating immediately, with a web host or developer's help if needed. Technical summary The weakness is PHP Object Injection caused by deserialization of untrusted data, and the advisory classifies it under OWASP A3 Injection. The attack requires no authentication (unauthenticated access), and the CVSS score of 9.8 is given by Patchstack. The advisory says the affected versions are from n/a through 7.0 and lists <= 7.0 as vulnerable, with no official patched version stated ("No official patch available"). Patchstack has issued a mitigation rule that blocks attacks until an official patch is applied, and the advisory does not describe a manual workaround or specific detection signatures beyond that. The advisory does not state a CVSS vector string or whether exploitation has been observed in the wild, only that it is expected to be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects AivahThemes Patchstack AivahThemes Hostme v2 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112846	Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. ThemeREX Group, PatchstackThemeREX Group Save Life	NVD	Oct 23 13:17 UTC
CVE-2026-112846Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. Executive summary A deserialization flaw in the Save Life WordPress theme from ThemeREX Group lets attackers inject objects into the site, and the advisory rates it as highly dangerous with a CVSS score of 9.8. Versions 1.2.14 and earlier are affected. The advisory says no official patch is available, so the recommended immediate step is to update the theme if a fix exists, or to use the mitigation rule Patchstack has issued until an official patch can be tested and applied. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states it can be exploited without authentication (required privilege: Unauthenticated) and that it affects Save Life from n/a through 1.2.14, with vulnerable versions listed as <= 1.2.14. The advisory says no official patch is available and does not state a patched version. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available. The advisory does not state exploitation in the wild as confirmed, though it says exploitation is expected and that similar flaws are used in mass-exploit campaigns. Detection guidance beyond the Patchstack mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group Save Life NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	5.3	CVE-2026-114699	Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects... yoomoney, Patchstackyoomoney ЮKassa для WooCommerce, yoomoney yookassa, Patchstack WordPress ЮKassa для WooCommerce Plugin	NVD	Oct 22 09:17 UTC
CVE-2026-114699Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects... Executive summary A broken access control flaw affects the ЮKassa для WooCommerce WordPress plugin, versions 2.17.3 and earlier. The advisory rates it low severity with a CVSS score of 5.3 and says it is unlikely to be exploited. The recommended action is to update the plugin, but no patched version is stated as available. Technical summary The flaw is classified as Broken Access Control (OWASP A1), which lets users reach pages or actions they should not. The advisory states the required privilege is unauthenticated, meaning no login is needed, and the CVSS score is 5.3. Vulnerable versions are listed as <= 2.17.3. The advisory says no official patched version is available, so a fixed version is not stated. No workaround beyond updating the plugin or asking a hosting provider or developer for help is stated, and no detection guidance or evidence of exploitation in the wild is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects yoomoney Patchstack yoomoney ЮKassa для WooCommerce yoomoney yookassa Patchstack WordPress ЮKassa для WooCommerce Plugin NIST National Vulnerability DatabasePublished Oct 22, 2026 09:17 UTC Read the advisory
	Critical	9.3	CVE-2026-112327	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia:... TMS, PatchstackTMS Amelia	NVD	Oct 22 09:17 UTC
CVE-2026-112327Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia:... From the advisory Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects TMS Patchstack TMS Amelia NIST National Vulnerability DatabasePublished Oct 22, 2026 09:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited