CVE-2026-27337

CVE-2026-27337 is a Local File Inclusion vulnerability in the AncoraThemes Chronicle – Lifestyle Magazine & Blog WordPress Theme (Chronicle) affecting versions up to 1.0. Root cause: improper control of include/require filename handling in PHP (PHP Local File Inclusion). Exploitation details are ...

CVE-2026-27326

CVE-2026-27326 affects the AC Services | HVAC WordPress theme (window-ac-services), with Improper Handling of Include/Require in PHP leading to Local File Inclusion. Public reports (Wordfence) indicate the issue exists for theme versions up to 1.2.5 and is currently Unpatched. Affected component ...

CVE-2026-27326

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme window-ac-services allows PHP Local File Inclusion.This issue affects AC Services | HVAC, Air...

CVE-2026-27097

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes CasaMia | Property Rental Real Estate WordPress Theme casamia allows PHP Local File Inclusion.This issue affects CasaMia | Property Rental Real Estate WordPress Them...

CVE-2026-27097

CVE-2026-27097 affects AncoraThemes CasaMia WordPress Theme (≤1.1.2). The vulnerability is a PHP Local File Inclusion caused by improper control of filenames in include/require. Impact: potential disclosure of local files; CVSS 3.1Base 8.1 (High). Patch status in reports: Unpatched; remediation g...

CVE-2026-22456 WordPress Askka theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Askka askka allows PHP Local File Inclusion.This issue affects Askka: from n/a through = 1.0...

CVE-2026-22446 WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through = 1.8.1...

CVE-2026-22442

CVE-2026-22442 is a Local File Inclusion vulnerability in the WordPress Tribe theme (LaunchandSell Tribe) affecting versions up to 1.7.3. The issue is caused by improper handling of filename resolution in include/require statements, enabling an attacker to potentially include local files via PHP....

CVE-2026-22442 WordPress Tribe theme <= 1.7.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in LaunchandSell Tribe tribe allows PHP Local File Inclusion.This issue affects Tribe: from n/a through = 1.7.3...

CVE-2026-22439 WordPress Green Planet theme <= 1.1.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Green Planet green-planet allows PHP Local File Inclusion.This issue affects Green Planet: from n/a through = 1.1.14...

CVE-2026-22437 WordPress Playa theme <= 1.3.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Playa playa allows PHP Local File Inclusion.This issue affects Playa: from n/a through = 1.3.9...

CVE-2026-22436

CVE-2026-22436 describes an unauthenticated Local File Inclusion in the WordPress theme Helvig by Elated-Themes, affecting Helvig versions up to 1.0. The flaw arises from improper control of the filename used in PHP include/require statements (PHP Local File Inclusion). Public sources identify th...

CVE-2026-22431 WordPress Wabi-Sabi theme <= 1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Wabi-Sabi wabi-sabi allows PHP Local File Inclusion.This issue affects Wabi-Sabi: from n/a through = 1.2...

CVE-2026-22419

CVE-2026-22419 – Local File Inclusion in AncoraThemes Honor WordPress theme (vulnerable

CVE-2026-22421 WordPress Quantum theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Quantum quantum allows PHP Local File Inclusion.This issue affects Quantum: from n/a through = 1.0...

CVE-2026-22410

CVE-2026-22410 concerns Mikado-Themes Dolcino (WordPress Dolcino theme) with a Local File Inclusion due to Improper Control of Filename for Include/Require Statement. Affected: Dolcino versions through 1.6. Root cause: PHP Include/Require filename handling allows LFI. Impact: high severity potent...

CVE-2026-22397 WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Fleur fleur allows PHP Local File Inclusion.This issue affects Fleur: from n/a through = 2.2.1...

CVE-2026-22399 WordPress Holmes theme <= 1.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Holmes holmes allows PHP Local File Inclusion.This issue affects Holmes: from n/a through = 1.7...

CVE-2026-22389 WordPress Cocco theme <= 2.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Cocco cocco allows PHP Local File Inclusion.This issue affects Cocco: from n/a through = 2.0...

CVE-2026-22389

CVE-2026-22389 describes an unauthorized Local File Inclusion (LFI) vulnerability in the WordPress theme Mikado-Themes Cocco cocco (versions up to and including 1.5.1). The issue arises from improper control of filenames used in PHP include/require statements, effectively enabling an attacker to ...