CVE-2026-112859

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16...

CVE-2026-112856

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10...

CVE-2026-112851

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9...

CVE-2026-112852

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12...

CVE-2026-112846

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

EUVD-2026-108951

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

CVE-2026-112852 WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12...

CVE-2026-112852

The WordPress Helion theme (versions

EUVD-2026-108949

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12...

CVE-2026-112852 WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12...

EUVD-2026-108950

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9...

EUVD-2026-108947

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10...

EUVD-2026-108944

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16...

CVE-2026-112856 WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10...

CVE-2026-112856

The ThemeREX Group Vagabonds theme (versions up to and including 1.3.10 ) is vulnerable to a PHP Object Injection flaw due to the Deserialization of Untrusted Data . This vulnerability allows an attacker to inject objects, potentially leading to unauthorized code execution or system manipulation....

CVE-2026-112856 WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10...

CVE-2026-112859 WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16...

PT-2026-122066

Name of the Vulnerable Software and Affected Versions Save Life versions prior to 1.2.15 Description Save Life is subject to PHP Object Injection due to the deserialization of untrusted data. This allows unauthenticated attackers to inject a PHP Object. While no native POP chain a sequence of...

PT-2026-122072

Name of the Vulnerable Software and Affected Versions ThemeREX Group Helion versions prior to 1.1.13 Description An issue exists due to the deserialization of untrusted input, which allows unauthenticated attackers to perform PHP Object Injection. While no POP chain a sequence of gadgets used to...

PT-2026-122079

Name of the Vulnerable Software and Affected Versions Little Birdies versions prior to 1.3.17 Description ThemeREX Group Little Birdies allows Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain a sequenc...