Description
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
Published: 2025-11-06
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability originates from insecure deserialization of untrusted data in the VictorThemes Seil theme, allowing attackers to perform object injection. This weakness is classified as CWE-502 and can enable arbitrary code execution, compromising confidentiality, integrity, and availability of the affected WordPress site.

Affected Systems

All installations of the VictorThemes Seil theme version 1.7.1 or earlier are affected. The flaw exists from the theme’s inception up to and including 1.7.1; no newer version is known to be affected.

Risk and Exploitability

The EPSS score of less than 1% suggests limited exploitation activity to date, and the vulnerability is not listed in CISA KEV. However, the high CVSS score of 9.8 indicates severe potential impact if exploited. Attackers would need to supply malicious serialized data to the theme, which is likely achievable remotely via crafted HTTP requests or uploaded content, giving them potential to execute code on the server. Vigilance and timely patching are therefore essential.

Generated by OpenCVE AI on April 30, 2026 at 14:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Seil theme to any version newer than 1.7.1 to remove the vulnerable deserialization logic.
  • If an upgrade cannot be performed immediately, disable the Seil theme and switch to a secure alternative theme to eliminate exposure to the vulnerability.
  • Continuously monitor VictorThemes announcements for security patches and apply any new releases promptly to keep the site protected.

Generated by OpenCVE AI on April 30, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 11:30:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
References

Mon, 10 Nov 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 06 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 06 Nov 2025 16:00:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
Title WordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data Vulnerability
Weaknesses CWE-502
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:21.678Z

Reserved: 2025-06-27T10:28:11.949Z

Link: CVE-2025-53242

cve-icon Vulnrichment

Updated: 2025-11-10T19:30:45.696Z

cve-icon NVD

Status : Deferred

Published: 2025-11-06T16:15:55.473

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-53242

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T14:45:24Z

Weaknesses