Description
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects Royal Event: from n/a through 2.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ThemeREX | Royal Event | ≤ 2.0 | — |
Critical · 9.8
CVE-2026-119526
EUVD-2026-114283GHSA-jhpc-jcvx-rg2p
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
Published Oct 30, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack