SZB-086cf089b2
EUVD lists shop manager PHP object injection in Product Feed Manager up to 7.14.1 (EUVD-2026-114315)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- RexTheme
- Product
- Product Feed Manager
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a PHP Object Injection flaw in Product Feed Manager versions 7.14.1 and earlier, scored 7.2/10 under CVSS v3.1. The item is an automated EUVD alert and does not describe exploitation.
If you use RexTheme
Check whether Product Feed Manager 7.14.1 or earlier is installed
Update to a fixed release once available
Limit shop manager accounts to trusted staff
What the sources say 1
· Mastodon: “Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.” Source