28977 matches found
CVE-2026-28028 WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through = 1.0...
CVE-2026-28027
CVE-2026-28027 concerns the ThemeREX Kayon WordPress theme (Kayon) up to version 1.3, where an improper control of filenames for PHP include/require statements enables a PHP Local File Inclusion (LFI) vulnerability. The issue is described as affecting Kayon from n/a through <= 1.3 and is liste...
CVE-2026-27998
CVE-2026-27998 : Local File Inclusion in ThemeREX Vixus (WordPress) due to improper control of filenames for PHP include/require. Affected: Vixus vixus
CVE-2026-27992
CVE-2026-27992 is a Local File Inclusion in ThemeREX Meals & Wheels meals-wheels (
CVE-2026-27438 WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through = 1.7...
CVE-2026-27336
CVE-2026-27336 details a Local File Inclusion in the AncoraThemes Consultor WordPress Theme (versions
CVE-2026-22478
CVE-2026-22478 affects the WordPress theme FindAll (
CVE-2026-22471
CVE-2026-22471 concerns the WordPress plugin Secudeal Payments for Ecommerce (versions n/a through 1.1). The issue is a PHP Object Injection via deserialization of untrusted data in the plugin, as described in the CVE entry. Connected sources confirm this vulnerability exists in Secudeal Payments...
CVE-2026-22456 WordPress Askka theme <= 1.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Askka askka allows PHP Local File Inclusion.This issue affects Askka: from n/a through = 1.0...
CVE-2026-22449
CVE-2026-22449 affects WordPress theme Don Peppe (Don Peppe: <= 1.3). The vulnerability is a PHP Local File Inclusion caused by Improper Control of Filename for Include/Require (PHP Remote File Inclusion). Wordfence notes this as an unauthenticated LFI vulnerability and indicates it remains un...
CVE-2026-22452 WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Hoverex hoverex allows PHP Local File Inclusion.This issue affects Hoverex: from n/a through = 1.5.10...
CVE-2026-22428
CVE-2026-22428 corresponds to WordPress Tooth Fairy theme
CVE-2026-22414
CVE-2026-22414 : Local File Inclusion in Mikado-Themes Marra (WordPress theme) up to version 1.2, caused by improper control of filenames used in include/require statements (PHP). Affected product: Marra theme (WordPress) <= 1.2. CVSS 3.1 indicates network attack vector, high impact on confide...
CVE-2026-22387 WordPress Aviana theme <= 2.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Aviana aviana allows PHP Local File Inclusion.This issue affects Aviana: from n/a through = 2.1...
CVE-2026-1273
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the /ultp/v3/starterdummypost/ and /ultp/v3/starterimportcontent/ REST API endpoints. This makes it possible...
GHSA-XXPW-32HF-Q8V9 AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
Summary The official docker-compose.yml publishes the memcached service on host port 11211 0.0.0.0:11211 with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data ...
EUVD-2026-9474
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass...
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler. The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In...
GHSA-C7MQ-GH6Q-6Q7C opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler. The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In...
WordPress plugin Remons 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...