CVE-2026-28077

CVE-2026-28077 is a Local File Inclusion vulnerability in the WordPress ThemeREX Vapester theme ( Vapester ) affecting versions up to 1.1.10. The issue is described as Improper Control of Filename for Include/Require Statement in PHP, i.e., a PHP Remote File Inclusion capability that effectively ...

CVE-2026-28074 WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through = 1.4.0...

CVE-2026-28065 WordPress Eject theme <= 2.17 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Eject eject allows PHP Local File Inclusion.This issue affects Eject: from n/a through = 2.17...

CVE-2026-28061 WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Tiger Claw tiger-claw allows PHP Local File Inclusion.This issue affects Tiger Claw: from n/a through = 1.1.14...

CVE-2026-28036

CVE-2026-28036 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Ratatouille WordPress Theme (SkatDesign) version 1.2.6 and earlier. The connected Wordfence report documents it as an authenticated issue (Subscriber+), indicating exploitation would require valid credentials and a...

CVE-2026-28036 WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through = 1.2.6...

CVE-2026-28036 WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through = 1.2.6...

CVE-2026-28028 WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through = 1.0...

CVE-2026-28027

CVE-2026-28027 concerns the ThemeREX Kayon WordPress theme (Kayon) up to version 1.3, where an improper control of filenames for PHP include/require statements enables a PHP Local File Inclusion (LFI) vulnerability. The issue is described as affecting Kayon from n/a through &lt;= 1.3 and is liste...

CVE-2026-27998

CVE-2026-27998 : Local File Inclusion in ThemeREX Vixus (WordPress) due to improper control of filenames for PHP include/require. Affected: Vixus vixus

CVE-2026-27992

CVE-2026-27992 is a Local File Inclusion in ThemeREX Meals & Wheels meals-wheels (

CVE-2026-27438 WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through = 1.7...

CVE-2026-27336

CVE-2026-27336 details a Local File Inclusion in the AncoraThemes Consultor WordPress Theme (versions

CVE-2026-22478

CVE-2026-22478 affects the WordPress theme FindAll (

CVE-2026-22471

CVE-2026-22471 concerns the WordPress plugin Secudeal Payments for Ecommerce (versions n/a through 1.1). The issue is a PHP Object Injection via deserialization of untrusted data in the plugin, as described in the CVE entry. Connected sources confirm this vulnerability exists in Secudeal Payments...

CVE-2026-22456 WordPress Askka theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Askka askka allows PHP Local File Inclusion.This issue affects Askka: from n/a through = 1.0...

CVE-2026-22452 WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Hoverex hoverex allows PHP Local File Inclusion.This issue affects Hoverex: from n/a through = 1.5.10...

CVE-2026-22449

CVE-2026-22449 affects WordPress theme Don Peppe (Don Peppe: &lt;= 1.3). The vulnerability is a PHP Local File Inclusion caused by Improper Control of Filename for Include/Require (PHP Remote File Inclusion). Wordfence notes this as an unauthenticated LFI vulnerability and indicates it remains un...

CVE-2026-22428

CVE-2026-22428 corresponds to WordPress Tooth Fairy theme

CVE-2026-22414

CVE-2026-22414 : Local File Inclusion in Mikado-Themes Marra (WordPress theme) up to version 1.2, caused by improper control of filenames used in include/require statements (PHP). Affected product: Marra theme (WordPress) &lt;= 1.2. CVSS 3.1 indicates network attack vector, high impact on confide...