CVE-2026-28085 WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Mahogany mahogany allows PHP Local File Inclusion.This issue affects Mahogany: from n/a through = 2.9...

CVE-2026-28084

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Bazinga bazinga allows PHP Local File Inclusion.This issue affects Bazinga: from n/a through = 1.1.9...

CVE-2026-28081

CVE-2026-28081 is a PHP Local File Inclusion in ThemeREX Windsor (Windsor) versions

CVE-2026-28075

The CVE-2026-28075 entry concerns the WordPress Porto theme (Porto Porto) with a Reflected XSS vulnerability in Porto versions up to 7.6.2. The issue is described as Improper Neutralization of Input During Web Page Generation, enabling reflected cross-site scripting. Affected product: Porto theme...

CVE-2026-28076 WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Frenify Guff guff allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Guff: from n/a through = 1.0.1...

CVE-2026-28077 WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Vapester vapester allows PHP Local File Inclusion.This issue affects Vapester: from n/a through = 1.1.10...

CVE-2026-28077 WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Vapester vapester allows PHP Local File Inclusion.This issue affects Vapester: from n/a through = 1.1.10...

CVE-2026-28076 WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Frenify Guff guff allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Guff: from n/a through = 1.0.1...

CVE-2026-28076

The CVE-2026-28076 entry describes a Missing Authorization vulnerability in Frenify Guff guff (WordPress theme) affecting versions n/a through 1.0.1. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields base score 7.5 (HIGH). Red Hat and CVE enrichment sources corroborate Missing Authorizat...

CVE-2026-28075 WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in p-themes Porto porto allows Reflected XSS.This issue affects Porto: from n/a through = 7.6.2...

CVE-2026-28075 WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in p-themes Porto porto allows Reflected XSS.This issue affects Porto: from n/a through = 7.6.2...

CVE-2026-28077

CVE-2026-28077 is a Local File Inclusion vulnerability in the WordPress ThemeREX Vapester theme ( Vapester ) affecting versions up to 1.1.10. The issue is described as Improper Control of Filename for Include/Require Statement in PHP, i.e., a PHP Remote File Inclusion capability that effectively ...

CVE-2026-28068 WordPress Rhythmo theme <= 1.3.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Rhythmo rhythmo allows PHP Local File Inclusion.This issue affects Rhythmo: from n/a through = 1.3.4...

CVE-2026-28074 WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through = 1.4.0...

CVE-2026-28069

CVE-2026-28069 is a Local File Inclusion vulnerability in the WordPress theme Le Truffe (≤ 1.1.7) stemming from improper control of filename for include/require statements in PHP. The issue allows PHP Local File Inclusion and has a high overall impact (CVSS v3.1: 8.1, High; network attack vector,...

CVE-2026-28069 WordPress Le Truffe theme <= 1.1.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Le Truffe letruffe allows PHP Local File Inclusion.This issue affects Le Truffe: from n/a through = 1.1.7...

CVE-2026-28074

CVE-2026-28074 describes a Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse (WordPress theme) affecting versions from n/a through

CVE-2026-28068

CVE-2026-28068 affects the WordPress Rhythmo theme (Rhythmo) versions

CVE-2026-28066

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through = 2.17...

CVE-2026-28063 WordPress Asia Garden theme <= 1.3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Asia Garden asia-garden allows PHP Local File Inclusion.This issue affects Asia Garden: from n/a through = 1.3.1...