CVE-2026-28064

CVE-2026-28064 affects the ThemeREX Edge Decor WordPress theme (edge-decor) up to version 2.2. It is a Local File Inclusion caused by improper filename handling in PHP include/require statements. The CVSS 3.1 vector indicates NETWORK attack, HIGH impact on confidentiality, integrity, and availabi...

CVE-2026-28066

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through = 2.17...

CVE-2026-28057 WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Mandala mandala allows PHP Local File Inclusion.This issue affects Mandala: from n/a through = 2.8...

CVE-2026-28045

CVE-2026-28045 refers to a Local File Inclusion in the WordPress theme “N7 | Golf Club Sports & Events” by ThemeREX. The issue is described as an “Improper Control of Filename for Include/Require Statement in PHP Program,” affecting the theme up to version

CVE-2026-27388

Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through = 2.0...

CVE-2026-27382 WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through = 2.13...

CVE-2026-27376 WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through = 2.2.7...

CVE-2026-24960 WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Charety charety allows Using Malicious Files.This issue affects Charety: from n/a through 2.0.2...

CVE-2026-22479

CVE-2026-22479 describes a missing authorization flaw in the WordPress plugin Easy Post Submission (versions up to 2.4.0). The issue is a Broken Access Control vulnerability allowing exploitation of misconfigured access levels, with the CVSSv3.1 base score of 7.5 (HIGH) and an attack vector of NE...

CVE-2026-22427

CVE-2026-22427 describes a Local File Inclusion vulnerability in Mikado-Themes GoTravel WordPress theme (GoTravel) versions up to 2.1, caused by improper control of the filename in PHP include/require. Public records (NVD/Red Hat/CVE feeds) confirm the issue and rate it high (CVSS v3.1 base score...

CVE-2026-22427 WordPress GoTravel theme <= 2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes GoTravel gotravel allows PHP Local File Inclusion.This issue affects GoTravel: from n/a through = 2.1...

CVE-2026-22419

CVE-2026-22419 – Local File Inclusion in AncoraThemes Honor WordPress theme (vulnerable

PT-2026-23329

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Police Department police-department allows PHP Local File Inclusion.This issue affects Police Department: from n/a through = 2.17...

PT-2026-23358

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Windsor windsor allows PHP Local File Inclusion.This issue affects Windsor: from n/a through = 2.5.0...

PT-2026-23346

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through = 2.17...

Traefik 资源管理错误漏洞

Traefik is an open-source reverse proxy and load balancing tool developed by Traefik. Versions prior to Traefik 2.11.38 and 3.6.9 contained a resource management vulnerability. This vulnerability stemmed from defects in the TCP router’s handling of TLS handshakes. It could allow unverified remote...

WordPress plugin Legrand 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-23256

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through = 2.13...

PT-2026-23239

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through = 2.1.9...

GHSA-6RX5-M2RC-HMF7 ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

Summary A vulnerability in Zitadel's login V2 interface was discovered, allowing for possible account takeover. Impact Zitadel allows organization administrators to change the default redirect URI for their organization. This setting enables them to redirect users to an arbitrary location after...