CVE-2025-67946

CVE-2025-67946 affects the WordPress theme AdForest (AdForest: <= 6.0.11). The issue is described as an improper control of the filename for include/require, leading to a Local File Inclusion (LFI) vulnerability (initial description mentions a PHP Remote File Inclusion context but the observab...

CVE-2025-67949 WordPress Hostiko theme < 94.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through 94.3.6...

CVE-2025-67946 WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through = 6.0.11...

CVE-2025-67941

CVE-2025-67941 refers to a Local File Inclusion in WordPress theme The Aisle by Elated-Themes, caused by improper control of filename for include/require statements in PHP. Affects The Aisle versions prior to 2.9.1. Impact is local file inclusion via PHP, enabling access to local files. Public ad...

CVE-2025-67941 WordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Inclusion.This issue affects The Aisle: from n/a through 2.9.1...

CVE-2025-67940

CVE-2025-67940 — Mikado-Themes Powerlift Local File Inclusion (LFI) Description in sources confirms an improper control of filenames for include/require in the PHP code, enabling PHP Local File Inclusion via PHP Remote File Inclusion vectors. The vulnerability affects Powerlift versions before 3....

CVE-2025-67940 WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through 3.2.1...

CVE-2025-67941 WordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Inclusion.This issue affects The Aisle: from n/a through 2.9.1...

CVE-2025-67938

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inclusion.This issue affects Biagiotti: from n/a through 3.5.2...

CVE-2025-67938 WordPress Biagiotti theme < 3.5.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inclusion.This issue affects Biagiotti: from n/a through 3.5.2...

CVE-2025-67938 WordPress Biagiotti theme < 3.5.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inclusion.This issue affects Biagiotti: from n/a through 3.5.2...

CVE-2025-67620

CVE-2025-67620 — Reflected Cross-Site Scripting in CleverSoft Anon anon2x. The flaw arises from improper neutralization of input during web page generation, affecting Anon theme versions

CVE-2025-67619

CVE-2025-67619 describes a PHP object-injection via deserialization in the WordPress Kids Heaven theme (Kids Heaven: kids-world) for versions up to and including 3.2. Root cause: deserialization of untrusted data leading to object injection. Impact: high (per CVSS) across confidentiality, integri...

CVE-2025-67938

CVE-2025-67938 describes an unauthenticated Local File Inclusion in the WordPress theme Mikado-Themes Biagiotti, due to improper control of filenames for include/require in PHP (a PHP Remote File Inclusion condition). Affected software: Biagiotti versions before 3.5.2. Red Hat and CVE records cor...

CVE-2025-67619 WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through = 3.2...

CVE-2025-67620 WordPress Anon theme <= 2.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CleverSoft Anon anon2x allows Reflected XSS.This issue affects Anon: from n/a through = 2.2.10...

CVE-2025-67619 WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through = 3.2...

CVE-2025-67620 WordPress Anon theme <= 2.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CleverSoft Anon anon2x allows Reflected XSS.This issue affects Anon: from n/a through = 2.2.10...

CVE-2025-67614 WordPress TheNa theme <= 1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through = 1.5.5...

CVE-2025-67615 WordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through = 1.5.1...