CVE-2026-32518

CVE-2026-32518 affects the WordPress Gaea theme (imithemes Gaea) prior to version 3.8. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Affected component is the theme code handling user-supplied input; impact is...

CVE-2026-32516

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Blind SQL Injection.This issue affects Miraculous Core Plugin: from n/a through 2.1.2...

CVE-2026-32518 WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in imithemes Gaea gaea allows Reflected XSS.This issue affects Gaea: from n/a through 3.8...

CVE-2026-32511

CVE-2026-32511 refers to a Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål (WordPress Stål theme) that allows Object Injection. The issue affects Stål versions before 1.7. The root cause is deserializing untrusted data, enabling object instantiation through crafted input. Pu...

CVE-2026-32512 WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through 1.10...

CVE-2026-32510

CVE-2026-32510 affects WordPress Kamperen theme versions prior to 1.3. The issue is a Deserialization of Untrusted Data vulnerability that allows Object Injection, caused by deserializing untrusted data. Impact per metrics is Low confidentiality and integrity impact, no availability impact, with ...

CVE-2026-32510 WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through 1.3...

CVE-2026-32508 WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability

Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through 1.8...

CVE-2026-32489 WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through 2.0.30...

CVE-2026-32489

CVE-2026-32489 affects the WordPress plugin b-blocks (bPlugins B Blocks) , specifically versions prior to 2.0.30 . The issue is a Missing Authorization / Broken Access Control due to incorrectly configured access control security levels . Publicly exploitable over the network with low attack comp...

CVE-2026-31913 WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through 1.5.16...

CVE-2026-31913 WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through 1.5.16...

CVE-2026-25380

CVE-2026-25380 concerns the Feedy WordPress theme by jwsthemes. The vulnerability is an unauthenticated Local File Inclusion (LFI) in Feedy versions prior to 2.1.5, arising from improper filename handling in PHP file inclusion (Linked to the broader description of PHP Remote File Inclusion but ma...

CVE-2026-25360

CVE-2026-25360 corresponds to a Deserialization of Untrusted Data vulnerability in the Vex plugin by Vex (Vex) for WordPress. Affected product: Vex = 1.2.9). Connected Wordfence details also list the CVE-2026-25360 under the Wordfence vulnerability repository with the same patched status and attr...

CVE-2026-25354 WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through 1.4.8...

CVE-2026-25354

CVE-2026-25354 affects the WordPress Reebox theme (versions prior to 1.4.8). The Root Cause is improper neutralization of input during web page generation, resulting in a Reflected XSS vulnerability. Impact per sources is that arbitrary scripts can be injected into web pages when a user visits a ...

CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through 2.8.2...

CVE-2026-25350 WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through 1.5.3...

CVE-2026-25352

CVE-2026-25352 is a confirmed Reflected XSS in the WordPress theme MyDecor. Affected products: MyDecor versions prior to 1.5.9. The entry documents a reflected cross-site scripting flaw arising from improper input neutralization during web page generation, enabling a reflected payload to execute ...

CVE-2026-25033 WordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in uixthemes Motta Addons motta-addons allows Reflected XSS.This issue affects Motta Addons: from n/a through 1.6.1...