### [CVE-2022-3359](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3359)
![](https://img.shields.io/static/v1?label=Product&message=Shortcodes%20and%20extra%20features%20for%20Phlox%20theme&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%200%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%20Deserialization%20of%20Untrusted%20Data&color=brighgreen)

### Description

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

### POC

#### Reference
- https://wpscan.com/vulnerability/08f3ce22-94a0-496a-aaf9-d35b6b0f5bb6

#### Github
No PoCs found on GitHub currently.