Lucene search
+L

19673 matches found

EUVD
EUVD
added 2026/08/18 2:00 p.m.10 views

EUVD-2026-60816

Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme = 2.17.22 versions...

5.3CVSS5.2AI score0.0024EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/18 2:00 p.m.38 views

CVE-2026-74008

The WordPress "Shortcodes and extra features for Phlox theme" plugin (auxin-elements) version 2.17.22 and earlier exposes sensitive data without authentication, rated CVSS 5.3 (MEDIUM). CISA SSVC shows no known exploitation. No patch version is mentioned in the provided documents; update to a new...

5.3CVSS5.2AI score0.0024EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/18 1:59 p.m.28 views

CVE-2026-32464 WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

8.1CVSS0.00274EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/18 1:59 p.m.11 views

EUVD-2026-60900

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

8.1CVSS5.2AI score0.00274EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/18 1:59 p.m.40 views

CVE-2026-32464

The WordPress plugin Theme Test Drive (versions ≤ 2.9.1) is affected by an unauthenticated Local File Inclusion vulnerability discovered by Steven Julian, allowing remote attackers to read arbitrary server files without authentication (CVSS 8.1 HIGH). Patchstack reports the flaw but no patch vers...

8.1CVSS5.2AI score0.00274EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/18 1:59 p.m.34 views

CVE-2026-32464

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

8.1CVSS5.2AI score0.00274EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/08/17 5:10 p.m.19 views

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.22...

5.3CVSS5.3AI score0.0024EPSS
SaveExploits0Affected Software1
OSV
OSV
added 2026/08/17 5:41 a.m.10 views

BIT-GHOST-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

6.6CVSS5.3AI score0.0029EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/16 6:16 a.m.12 views

CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

5.4CVSS0.00157EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/08/16 6:00 a.m.20 views

CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

5.4AI score0.00157EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/08/16 6:00 a.m.16 views

EUVD-2026-59909

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

5.4AI score0.00157EPSS
SaveExploits1References1
CVE
CVE
added 2026/08/16 6:00 a.m.51 views

CVE-2026-13712

Divi WordPress theme versions 5.0 through 5.8.1 is vulnerable to contributor-level stored XSS via the Social Media Follow module's Skype URL field; malicious JavaScript stored by a low-privileged user executes when an administrator views the post. CVSS 5.4 medium. Patch to version 5.9.0. No in-th...

5.4CVSS5.3AI score0.00157EPSS
SaveExploits1References1
Wordfence Blog
Wordfence Blog
added 2026/08/14 2:26 p.m.18 views

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)

Last week, there were 294 vulnerabilities disclosed in 233 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 149 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

7.3AI score
SaveExploits0
Patchstack
Patchstack
added 2026/08/14 10:50 a.m.10 views

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...

8.1CVSS5.3AI score0.00274EPSS
SaveExploits0Affected Software1
WPVulnDB
WPVulnDB
added 2026/08/14 12:00 a.m.13 views

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post. Po...

5.4CVSS5.4AI score0.00157EPSS
SaveExploits1
NVD
NVD
added 2026/08/13 3:19 p.m.14 views

CVE-2026-28154

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...

7.1CVSS0.00182EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/13 2:25 p.m.32 views

CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...

7.1CVSS0.00182EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/13 2:25 p.m.42 views

CVE-2026-28154

CVE-2026-28154 concerns reflected Cross-Site Scripting (XSS) in two WordPress themes: Samex - Clean, Minimal Shop WooCommerce Theme (affected up to version 2.5) and M.Anh - Fashion WooCommerce Theme (affected up to version 1.7). The issue arises from improper input neutralization during web page ...

7.1CVSS5.2AI score0.00182EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/13 2:25 p.m.10 views

EUVD-2026-58084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...

7.1CVSS5.2AI score0.00182EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/13 1:37 p.m.16 views

CVE-2026-66691

Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...

9.8CVSS5.2AI score0.00321EPSS
SaveExploits0References2
Rows per page
Query Builder