helion
helion is a WordPress theme with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 23, 2026; the highest published CVSS base score is 8.1.
helionCVE-2026-112852: Helion: Unsafe object deserialization
An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. The vector rates attack complexity as high; the additional conditions are not disclosed. Affected versions: at most 1.1.12.
| Safe version |
|
||
|---|---|---|---|
| Oct 23, 2026 |
CVE-2026-112852
Helion: Unsafe object deserialization
An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. The vector rates attack complexity as high; the additional conditions are not disclosed. Affected versions: at most 1.1.12.
|
1.1.15.2 |
CVE8.1
|
| Mar 05, 2026 |
CVE-2026-28024
Helion: Filesystem traversal
Helion is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.1
|