513 matches found
WordPress Starto theme <= 2.1.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Starto versions = 2.1.9...
CVE-2025-52744
Improper Control of Generation of Code 'Code Injection' vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through = 1.0...
CVE-2026-22381
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows PHP Local File Inclusion.This issue affects PawFriends - Pet Shop and Veterinary WordPress...
CVE-2026-22370
Summary (CVE-2026-22370): WordPress theme Marveland (vendor: axiomthemes) versions through 1.3.0 are affected by an unauthenticated Local File Inclusion due to improper control of the filename in PHP include/require statements. The vulnerability impacts Marveland in WordPress environments; CVSS v...
CVE-2025-69408 WordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes HealthFirst healthfirst allows PHP Local File Inclusion.This issue affects HealthFirst: from n/a through = 1.0.1...
CVE-2025-69409 WordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes PJ | Life & Business Coaching pj allows PHP Local File Inclusion.This issue affects PJ | Life & Business Coaching: from n/a through = 3.0.0...
CVE-2025-67995 WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through 2.1...
CVE-2026-25374 WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through = 1.3.2...
CVE-2026-23542
CVE-2026-23542 is a PHP Object Injection vulnerability in the WordPress theme “Grand Restaurant” (Theme Goods) 7.0.10) or follow vendor patch guidance. Other connected sources corroborate the vulnerability name and affected software. Technical details such as root cause specifics, exploit vector...
PT-2026-20578
Name of the Vulnerable Software and Affected Versions Drift versions prior to 1.5.1 Description The Drift theme for WordPress is susceptible to Stored Cross-Site Scripting through the post title. Insufficient input sanitization and output escaping allow authenticated attackers with...
WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Fana versions = 1.1.35...
WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.13 - Unauthenticated Draft Posts Information Exposure vulnerability
Unauthenticated Draft Posts Information Exposure vulnerability discovered by Nguyen C in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.13...
CVE-2025-69049
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Töbel tobel allows PHP Local File Inclusion.This issue affects Töbel: from n/a through = 1.6...
CVE-2026-22396 WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through = 1.0...
CVE-2026-22391 WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through = 1.5.1...
CVE-2025-69314
CVE-2025-69314 describes a PHP Local File Inclusion in the WordPress theme Werkstatt (fuelthemes) exploitable via improper control of the filename used by include/require. Affected: Werkstatt versions before 4.8.3 (i.e.,
CVE-2025-69062
CVE-2025-69062 affects the WordPress Weedles theme, up to version
CVE-2025-69049
CVE-2025-69049 is a Local File Inclusion vulnerability in the WordPress theme Töbel by Elated-Themes, described as Improper Control of Filename for Include/Require Statement ('PHP Remote File Inclusion') that permits PHP Local File Inclusion. Public records (NVD/Red Hat/CVE lists) attribute the i...
CVE-2025-68538 WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through = 2.3.6...