Description
Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LoftOcean | CozyStay | ≤ 1.7.1 | — |
Critical · 9.8
CVE-2025-49507
EUVD-2025-17672GHSA-77r3-7jcc-r6rj
WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability
Published Jun 10, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack