CVE-2026-81779

CVE-2026-81779 is a backdoor vulnerability in the Silk Themes Newspapers X WordPress theme, discovered by ashv4ni and reported via Patchstack . It affects versions 1.0.46 through 1.0.48 and is classified as Improper Validation of Specified Quantity in Input , allowing malicious software to be imp...

CVE-2026-81291 WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-81291

CVE-2026-81291 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Uncode theme , affecting versions ≤ 2.12.7 . The vulnerability was discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. With a CVSS 3.1 score of 7.1 (HIGH) , it has a network attack vector , low co...

CVE-2026-82664

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible...

CVE-2026-82666

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

EUVD-2026-68435

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

CVE-2026-82666 yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

CVE-2026-82666

A code injection flaw exists in yaojingang GEOFlow up to version 2.1.0 , specifically in the preview function of app/Http/Controllers/Admin/SiteThemeEditorController.php within the Superadmin Theme Editor component. Manipulation of the blade argument allows remote code injection. The flaw require...

CVE-2026-82664

A cross-site scripting (XSS) vulnerability in yaojingang GEOFlow up to version 2.1.0 allows a remote attacker to execute arbitrary JavaScript in a victim's browser. The flaw resides in the JSON-LD Theme Handler within app/Http/Controllers/Site/HomeController.php, where improper handling of the Se...

CVE-2026-82664 yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible...

EUVD-2026-68432

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible...

CVE-2026-82664 yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible...

WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Backdoor vulnerability discovered by ashv4ni in WordPress Theme Newspapers X versions 1.0.46-1.0.48...

WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Theme Uncode versions = 2.12.7...

CVE-2026-78289 WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...

CVE-2026-78289

CVE-2026-78289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the CozyStay WordPress theme, affecting versions 1.10.0 and earlier . The vulnerability was discovered by G0053 and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, requiring user interaction. The at...

WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability

Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...

CVE-2026-32639

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...