rascals vulnerabilities

Products

• Noisa 2
• Angio 1
• Meloo 1
• Pendulum 1
• Vex 1

Latest rascals CVEs

Newest publication first

1. CVE-2026-62021 WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

   Published 2026-10-10

   High·CVSS 8.8 EPSS 0.47%

   Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

2. CVE-2026-25360 WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability

   Published 2026-03-25

   High·CVSS 8.8 EPSS 0.37%

   Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.

3. CVE-2026-25359 WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability

   Published 2026-03-25

   High·CVSS 8.8 EPSS 0.37%

   Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.

4. CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

   Published 2026-03-25

   High·CVSS 8.8 EPSS 0.37%

   Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.

5. CVE-2025-60039 WordPress Noisa theme <= 2.6.0 - PHP Object Injection vulnerability

   Published 2025-10-22

   Critical·CVSS 9.8 EPSS 0.49%

   Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.

6. CVE-2025-53560 WordPress Noisa theme <= 2.6.0 - PHP Object Injection Vulnerability

   Published 2025-08-20

   High·CVSS 8.8 EPSS 0.42%

   Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.