The Stylemix uListing WordPress plugin contains an insecure deserialization routine that accepts untrusted data and performs PHP unserialization. Because the plugin does not validate or sanitize the serialized input, an attacker could craft a payload that instantiates arbitrary PHP objects. This form of object injection might allow unauthorized manipulation of application data or execution of malicious code when the objects are processed by the plugin. The description does not explicitly state that remote code execution is guaranteed, so this potential consequence is inferred from the nature of the vulnerability.

The vulnerability affects the Stylemix uListing plugin for WordPress versions 2.2.0 and earlier. Any WordPress site that is running the plugin at or below this version is potentially impacted.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score is below 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any input that the plugin deserializes, such as form submissions or URL parameters; this inference is based on the plugin's handling of serialized data.