CVE-2026-118078

Name of the Vulnerable Software and Affected Versions Product Catalog Feed by PixelYourSite versions prior to 3.1.5

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with shop manager-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update Product Catalog Feed by PixelYourSite to version 3.1.5 or later.