CVE-2026-62020 WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in TouchUp 1.4 versions...

CVE-2026-62020

The WordPress TouchUp theme (versions prior to 1.4 ) is vulnerable to an unauthenticated Local File Inclusion (LFI) . This vulnerability is associated with CWE-98 , involving improper control of filenames in PHP include/require statements. The impact of successful exploitation is rated as High , ...

EUVD-2026-96458

Unauthenticated Local File Inclusion in DukaMarket = 1.3.0 versions...

CVE-2026-48194 WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in DukaMarket = 1.3.0 versions...

CVE-2026-48194

The DukaMarket WordPress theme (versions

CVE-2026-48193 WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uminex = 1.0.9 versions...

CVE-2026-48193

The WordPress Uminex theme versions

EUVD-2026-96457

Unauthenticated Local File Inclusion in Uminex = 1.0.9 versions...

EUVD-2026-96455

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

CVE-2026-42724

The WordPress CleanSkin theme (versions

CVE-2026-42777

The WordPress Aalto theme (versions

CVE-2026-42777 WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

CVE-2026-42724 WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in CleanSkin = 1.5.0 versions...

EUVD-2026-96454

Unauthenticated Local File Inclusion in CleanSkin = 1.5.0 versions...

EUVD-2026-96441

Unauthenticated Local File Inclusion in Kids Care = 3.2.4 versions...

CVE-2026-42704

The Kids Care WordPress theme (versions

CVE-2026-42704 WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Kids Care = 3.2.4 versions...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

CVE-2026-104899 GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...