The vulnerability is a PHP Object Injection caused by deserialization of untrusted data in the Stylemix uListing plugin. It can allow an attacker to supply a crafted serialized payload that results in malicious objects being instantiated, which may lead to arbitrary code execution on the hosting WordPress site. This weakness is classified as CWE‑502, Deserialization of Untrusted Data.

All installations of Stylemix uListing version 2.2.0 or earlier are affected. The plugin is used within WordPress sites, so any site running a vulnerable version should verify the plugin version and update or remove it as needed.

The CVSS score of 7.2 indicates a high severity if exploited, while the EPSS score of less than 1% suggests very few observed exploits to date, yet the risk is not negligible. The attack vector is most likely external, via a web request that supplies untrusted serialized data to the plugin. The vulnerability has not been reported in the CISA KEV catalog, meaning no known publicly available exploitation packages are tracked.