CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...

CVE-2026-111838

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

EUVD-2026-107275

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

CVE-2026-111838 WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

CVE-2026-111838

The ThemeHunk Customizer WordPress plugin (versions

PT-2026-120619

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Elieve in WordPress Plugin ThemeHunk Customizer versions = 2.8.7...

CVE-2026-81534

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

EUVD-2026-101864

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-81534 Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-81534

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 3.9.5 . The root cause is insufficient authorization and input sanitization within the send_test_mail() function, which allows for the injection of user-con...

PT-2026-114799

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send test mail function, which allows user-controlled PHP code to be written to...

CVE-2026-81534: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-103358

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...

CVE-2026-103358 WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...

EUVD-2026-100987

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...

CVE-2026-103358

The Email Template Customizer for WooCommerce plugin for WordPress (versions up to and including 1.3.4 ) is susceptible to a Code Injection vulnerability (CWE-94). This flaw allows an attacker to execute arbitrary code due to improper control over code generation. While the provided documents con...

CVE-2026-103358: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...

PT-2026-113954

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...