WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion

Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campresswoocommercegetajaxproducts' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication. id: CVE-2024-10763 info: name: WordPress Campress Theme =...

wpscvn

wpscvn 是一个面向渗透测试人员和网站所有者的工具，用于测试他们的网站是否存在有漏洞的插件或主题。 作者不对该工具的不良使用承担任何责任，请记住，未经事先同意攻击目标是非法的，并会受到法律惩罚。 需要： Python 3 用法：python3 script.py http://site...

CVE-2026-81281

CVE-2026-81281 is a Cross-Site Scripting (XSS) vulnerability in the Graphene WordPress theme , affecting versions 2.9.4 and earlier . The vulnerability requires a subscriber-level account (low privileges) and user interaction to be exploited. The CVSS v3.1 base score is 6.5 (MEDIUM) with a vector...

CVE-2026-66670 WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Måne = 1.7 versions...

WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khuong Hai & Thanh Nam HPT Vietnam in WordPress Theme Urna versions = 2.6.2...

CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Koji = 2.2.1 versions...

WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Homlisti versions = 3.1.2...

WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Shuffle versions = 1.8...

EUVD-2025-210641

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

Ghost: Theme Upload Path Traversal

Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for thi...

EUVD-2026-51940

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

CVE-2026-8167 Reflected XSS in theWP's News Theme V8

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026...

WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Theme Gillion versions = 4.13...

CVE-2026-57801 WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through = 2.1...

CVE-2026-57797

CVE-2026-57797 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress EduMall theme (ThemeMove EduMall) up to version 4.5.1. The NVD/CVE records and Patchstack entry indicate that access control levels were incorrectly configured, allowing unauthorized access to ...

CVE-2026-57789

Technical details about CVE-2026-57789 are not publicly available in the provided documents; please monitor for updates.

CVE-2026-57728

CVE-2026-57728 affects the WordPress Flatsome theme (UX-themes) versions up to and including 3.20.5. It is a Reflected Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation. The CVSSv3.1 base score is 7.1 (HIGH) with Network attack vector, no pri...

CVE-2026-57641 WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Real Estate 7 = 3.5.9 versions...

CVE-2026-54827

CVE-2026-54827 : Unauthenticated SQL Injection affecting WordPress Real Estate 7 theme versions ≤ 3.5.9. The vulnerability arises in the Real Estate 7 component and is exploitable without authentication, with a CVSS v3.1 base score of 9.3 (CRITICAL), indicating potential data exposure and confide...

WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Real Estate 7 versions = 3.5.9...