CVE-2026-17025

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17025

A flaw was found in graphene. Due to insufficient input sanitization and output escaping in user profile fields, an authenticated attacker with low-level privileges can conduct stored Cross-Site Scripting XSS attacks. By injecting malicious scripts into profile fields, an attacker can execute...

CVE-2026-17025

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.4 . The root cause is insufficient input sanitization and output escaping within the 'Current location' and 'Author profile image URL' profile fields. This allows authentica...

EUVD-2026-96115

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17025 Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Graphene theme <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Theme Graphene versions = 2.9.4...

create-graphene (>=0.0.24, <=0.0.30) potentially affected by CVE-2026-86597 via snowflake-sdk (3.1.0)

snowflake-sdk NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-sdk and may be impacted: - create-graphene =0.0.24, =0.0.30 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

create-graphene (>=0.0.24, <=0.0.30) potentially affected by CVE-2026-85525 via snowflake-sdk (3.1.0)

snowflake-sdk NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-sdk and may be impacted: - create-graphene =0.0.24, =0.0.30 Source cves: CVE-2026-85525 Source advisory: SNYK:JS-SNOWFLAKESDK-19638986...

CVE-2026-81281

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

EUVD-2026-70596

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281

CVE-2026-81281 is a Cross-Site Scripting (XSS) vulnerability in the Graphene WordPress theme , affecting versions 2.9.4 and earlier . The vulnerability requires a subscriber-level account (low privileges) and user interaction to be exploited. The CVSS v3.1 base score is 6.5 (MEDIUM) with a vector...

PT-2026-85086

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HieuPenguinnn in WordPress Theme Graphene versions = 2.9.4...

cosmicdbsemantic (>=0.0.30, <=0.0.37), fiduswriter (>=3.7.0a4, <=3.7.0a5) +3 more potentially affected by CVE-2026-15830 via django (2.2.3)

django PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.30, =3.7.0a4, =0.1.1, =1.1.2, =1.1.6 - rdmo 0.14.5 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

cosmicdbsemantic (>=0.0.30, <=0.0.37), fiduswriter (>=3.7.0a4, <=3.7.0a5) +3 more potentially affected by CVE-2026-8404 via django (2.2.3)

django PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.30, =3.7.0a4, =0.1.1, =1.1.2, =1.1.6 - rdmo 0.14.5 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

EUVD-2024-17700

Malicious code in bioql PyPI...

CVE-2024-1984

The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source...