Skip to main content

Js Archive List CVE-2026-32513

| EUVD-2026-15870 HIGH
Deserialization of Untrusted Data (CWE-502)
2026-03-25 Patchstack GHSA-g2rf-phpj-m3m9
Deserialization Js Archive List
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Re-analysis Queued
Apr 24, 2026 - 16:37 vuln.today
cvss_changed
EUVD ID Assigned
Mar 25, 2026 - 16:47 euvd
EUVD-2026-15870
Analysis Generated
Mar 25, 2026 - 16:47 vuln.today
CVE Published
Mar 25, 2026 - 16:15 nvd
HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.

AnalysisAI

A deserialization of untrusted data vulnerability in the JS Archive List jQuery widget (jquery-archive-list-widget) versions up to 6.1.7 allows remote attackers to inject malicious objects and achieve code execution or information disclosure. The vulnerability affects WordPress installations using the vulnerable plugin versions, and exploitation requires sending crafted serialized PHP objects to the affected endpoint. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to application with valid credentials
Delivery
Submit malicious serialized object to jquery-archive-list-widget
Exploit
Trigger unsafe deserialization in widget code
Execution
Inject arbitrary objects into application memory
Impact
Execute arbitrary code with application privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Authenticated user with login access to applications using Miguel Useche JS Archive List jquery-archive-list-widget version 6.1.7 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The risk assessment presents contradictory signals due to missing data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker crafts a malicious serialized PHP object containing a chain of gadget classes that are available in the WordPress or plugin codebase. The attacker sends this serialized payload via an HTTP GET or POST parameter to an endpoint in the jquery-archive-list-widget that performs unserialize() on untrusted input without validation. …
Remediation Upgrade JS Archive List (jquery-archive-list-widget) to a patched version released after 6.1.7 as soon as the vendor releases a fix (check the Patchstack database and official WordPress plugin repository for the latest secure version). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 7 days: Identify all affected systems and apply vendor patches promptly. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-32513 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy