Skip to main content

Wordpress Theme CVE-2025-52827

| EUVDEUVD-2025-19315 HIGH
Deserialization of Untrusted Data (CWE-502)
2025-06-27 audit@patchstack.com
WordPress Deserialization Wordpress Theme
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
EUVD ID Assigned
Mar 16, 2026 - 00:16 euvd
EUVD-2025-19315
Analysis Generated
Mar 16, 2026 - 00:16 vuln.today
CVE Published
Jun 27, 2025 - 12:15 nvd
HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in uxper Nuss allows Object Injection. This issue affects Nuss: from n/a through 1.3.3.

AnalysisAI

PHP object injection in the uxper Nuss WordPress theme through version 1.3.3 allows authenticated attackers with low privileges to execute arbitrary code or manipulate data via deserialization of untrusted input. Exploitation requires a valid WordPress account and the active theme; there is no evidence of active exploitation, and EPSS indicates low probability (0.16%).

More in Wordpress Theme

View all
CVE-2025-1307 CRITICAL
9.8 Mar 04

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
CVE-2019-25142 HIGH POC
8.8 Jun 07

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
CVE-2023-45657 HIGH
8.5 Nov 06

A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
CVE-2020-36721 MEDIUM POC
6.5 Jun 07

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
CVE-2024-52413 CRITICAL
9.8 Nov 16

Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
CVE-2025-48106 CRITICAL
10.0 Oct 22

Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to

CVE-2020-17362 MEDIUM POC
6.1 Aug 12

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
CVE-2025-49060 CRITICAL
10.0 Oct 22

Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers t
CVE-2026-39770 CRITICAL
10.0 Oct 06

Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote
CVE-2025-26927 CRITICAL
10.0 Apr 15

Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
CVE-2026-81779 CRITICAL
10.0 Aug 31

Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
CVE-2025-49071 CRITICAL
10.0 Jun 17

Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Share

CVE-2025-52827 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy