CVE-2025-60237 WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0...

CVE-2025-60237

CVE-2025-60237 affects the WordPress Finag theme up to version 1.5.0, describing a PHP Object Injection via deserialization of untrusted data. Reported across multiple sources (NVD, Red Hat, EUVD, CVE records, CVE List) with a CVSS v3.1 base score of 9.8 (CRITICAL), network attack vector, low att...

CVE-2025-60233 WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2...

CVE-2025-60233 WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2...

CVE-2025-60233

CVE-2025-60233 affects WordPress Zuut theme

CVE-2026-27093 WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ovatheme Tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a before 1.5.6...

CVE-2026-27093 WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through 1.5.6...

CVE-2026-27093

CVE-2026-27093 is a confirmed Local File Inclusion vulnerability in the WordPress Tripgo theme. The affected product is the Tripgo WordPress theme, with versions from before 1.5.6 (notably described as &lt; 1.5.6). The root cause is improper control of the filename for include/require statements ...

EUVD-2026-13053

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3...

CVE-2026-27096

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3...

CVE-2026-27096 WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3...

CVE-2026-27096

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3...

CVE-2026-27096 WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3...

CVE-2026-27096

CVE-2026-27096 : Deserialization of Untrusted Data vulnerability in the BuddhaThemes ColorFolio - Freelance Designer WordPress Theme (ColorFolio) up to version 1.3, enabling Object Injection. The issue is described across multiple sources (NVD/Red Hat ENISA/CIRCL, CVE list, PatchStack) with a CVS...

CVE-2026-28073 WordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS.This issue affects WP eMember: from n/a through v10.2.2...

CVE-2026-28073

CVE-2026-28073: Reflected Cross-Site Scripting in Tips and Tricks HQ WP eMember (WP eMember) affecting WP eMember versions from n/a through 10.2.2. Description and related feeds confirm the vulnerability as a Reflected XSS due to improper input neutralization during web page generation. Public re...

CVE-2026-28073 WordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS.This issue affects WP eMember: from n/a through v10.2.2...

PT-2026-26268

🚨 CVE-2025-60233: WordPress Zuut theme = 1.4.2 - ... PHP object injection in WordPress themes = instant RCE playground for attackers who can craft malicious serialized payl... https://t.co/IgpaLoPW1V netsec vulnerability CVE sysadmin zeroday...

PT-2026-26248

🟠 CVE-2026-27096 - High Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer Word... https://t.co/HOIbh9qxFx https://t.co/LcmJdGrhq3...

PT-2026-26269

🚨 CVE-2025-60237: Wor... Unauthenticated PHP object injection in WordPress theme with 9.8 CVSS - trivial RCE chain waiting to happen. WordPressSec PHPObjectInjection RCE. https://t.co/JStJpfMGvo netsec vulnerability CVE sysadmin zeroday...