CVE-2026-22428

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Tooth Fairy tooth-fairy allows PHP Local File Inclusion.This issue affects Tooth Fairy: from n/a through = 1.16...

CVE-2025-53335

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Berger berger allows PHP Local File Inclusion.This issue affects Berger: from n/a through = 1.1.1...

CVE-2026-28135

The CVE refers to WP Royal Elementor Addons (royal-elementor-addons) with versions up to 1.7.1052/1051 affected. Reported as an inclusion of functionality from an untrusted control sphere, which enables Accessing Functionality Not Properly Constrained by ACLs. Public sources (NVD, Red Hat, CVE li...

CVE-2026-28134

Improper Control of Generation of Code 'Code Injection' vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through = 3.7.2...

CVE-2026-28129 WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Little Birdies little-birdies allows PHP Local File Inclusion.This issue affects Little Birdies: from n/a through = 1.3.16...

CVE-2026-28122

CVE-2026-28122 is a Reflected Cross-Site Scripting vulnerability in the ListingPro WordPress plugin (ListingPro plugin) affecting versions up to 2.9.8. The issue arises from Improper Neutralization of Input During Web Page Generation, allowing an attacker to inject and execute script in a victim’...

CVE-2026-28109

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Reflected XSS.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through = 3.8...

CVE-2026-28105

Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through = 1.7.7...

CVE-2026-28104 WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Aryan Shirani Bid Abadi Site Suggest site-suggest allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Site Suggest: from n/a through = 1.3.9...

CVE-2026-28098 WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Save Life save-life allows PHP Local File Inclusion.This issue affects Save Life: from n/a through = 1.2.13...

CVE-2026-28099

CVE-2026-28099 refers to LambertGroup UberSlider Ultra (uberSlider_ultra) for WordPress. It is a Reflected XSS affecting UberSlider Ultra versions up to 2.3. The CVE notes improper neutralization of input during web page generation, enabling cross-site scripting. From the provided metrics, the CV...

CVE-2026-28093

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Ozisti ozisti allows PHP Local File Inclusion.This issue affects Ozisti: from n/a through = 1.1.10...

CVE-2026-28092

CVE-2026-28092 affects ThemeREX Sounder WordPress Theme (Sounder) up to version 1.3.11 due to Improper Control of Filename for Include/Require, allowing Local File Inclusion. This vulnerability could enable reading local files on vulnerable sites. Public details confirm affected product/version a...

CVE-2026-28089

CVE-2026-28089 is a reported Local File Inclusion in the WordPress theme Daiquiri (ThemeREX) up to version 1.2.4. The issue arises from improper control of filenames used in PHP include/require statements, enabling potential LFI. The description across sources confirms affected software (Daiquiri

CVE-2026-28079 WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Conquerors conquerors allows PHP Local File Inclusion.This issue affects Conquerors: from n/a through = 1.2.13...

CVE-2026-28079

CVE-2026-28079: Local File Inclusion in the WordPress Conquerors theme (versions &lt;= 1.2.13) due to Improper Control of Filename for Include/Require statements in PHP. Impact is Local File Inclusion with HIGH severity (CVSS 3.1: 8.1) and network attack vector, no user interaction required. Affe...

CVE-2026-28086

CVE-2026-28086 describes a Local File Inclusion in ThemeREX Run Gran (WordPress theme) versions up to and including 2.0, caused by Improper Control of Filename for Include/Require in PHP. The vulnerability allows an attacker to abuse include/require filename handling to access local files on the ...

CVE-2026-28074

Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through = 1.4.0...

CVE-2026-28066 WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through = 2.17...

CVE-2026-28061

CVE-2026-28061 is a Local File Inclusion vulnerability in the ThemeREX Tiger Claw WordPress theme, affecting versions up to and including 1.1.14. The issue stems from improper control of filenames in Include/Require statements, enabling PHP Local File Inclusion. Public references in the connected...