19661 matches found
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)
Last week, there were 294 vulnerabilities disclosed in 233 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 149 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post. Po...
CVE-2026-28154
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-28154
CVE-2026-28154 concerns reflected Cross-Site Scripting (XSS) in two WordPress themes: Samex - Clean, Minimal Shop WooCommerce Theme (affected up to version 2.5) and M.Anh - Fashion WooCommerce Theme (affected up to version 1.7). The issue arises from improper input neutralization during web page ...
EUVD-2026-58084
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-66691
Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...
CVE-2026-66653
CVE-2026-66653 corresponds to an unauthenticated Local File Inclusion in WordPress Barista theme (versions <= 2.5.1). The vulnerability affects the Barista theme’s file handling, enabling LFI with a high severity (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Root cause details are stated as...
CVE-2026-66653 WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...
CVE-2026-66465
CVE-2026-66465 affects WordPress Cartify theme (Cartify Multipurpose) versions up to and including 1.3.0.1, with unauthenticated broken authentication that can lead to account takeover. The connected documents confirm the vulnerability type and the affected version range but do not provide remedi...
CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-65582
CVE-2026-65582 affects the WordPress AI Hub theme (versions <= 1.3.10). The available documents describe a Subscriber Arbitrary File Download vulnerability in AI Hub
CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-65580
CVE-2026-65580 describes an unauthenticated Reflected Cross Site Scripting (XSS) vulnerability in the WordPress Agrion theme , affecting versions
CVE-2026-65580 WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...
CVE-2026-65580
Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...
PT-2026-71583
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...
GHSA-5C4F-9PQ9-6C77 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...