Critical · 9.8 CVE-2025-69404 EUVD-2025-207978GHSA-vp2m-r3pp-p859

WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability

Published Feb 20, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.

Affected products

Vendor	Product	Affected	Fixed
ThemeREX	Extreme Store	≤ 1.5.10	—

References

https://patchstack.com/database/Wordpress/Theme/extremestore/vulnerability/wordpress-extreme-store-theme-1-5-7-php-object-injection-vulnerability?_s_id=cve vdb-entry