PT-2026-22136 · WordPress · Ulisting

Phat Rio · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-28138

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stylemix uListing versions through 2.2.0

Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts the uListing component.

Recommendations Versions prior to and including 2.2.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-28138

Affected Products

Ulisting

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-28138 · Security Note
• https://t.me/CVEtracker/45843 · Telegram Post
• https://twitter.com/cracbot/status/2028787657992740992 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027019059405918387 · Twitter Post
• https://twitter.com/CVEnew/status/2027004182306132169 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-php-object-injection-vulnerability?_s_id=cve · Note