https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:44:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-325775 EUVD-2026-325775 https://cve.radiocsirt.org/vuln/euvd-2026-325775 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8365 <p>The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the &#39;blocksy_meta&#39; REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing &#39;&lt;&#39; or &#39;&gt;&#39; and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().</p> <p>The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the &#39;blocksy_meta&#39; REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing &#39;&lt;&#39; or &#39;&gt;&#39; and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-8365 https://cve.radiocsirt.org/vuln/ghsa-r622-c48h-h6qq <p>The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the &#39;blocksy_meta&#39; REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing &#39;&lt;&#39; or &#39;&gt;&#39; and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().</p> <p>The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the &#39;blocksy_meta&#39; REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing &#39;&lt;&#39; or &#39;&gt;&#39; and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().</p> https://cve.radiocsirt.org/vuln/ghsa-r622-c48h-h6qq