WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme LMS versions = 8.3...

WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Baikuya in WordPress Theme Motors versions = 1.4.108...

WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Martfury - WooCommerce Marketplace WordPress theme theme = 3.3.9 - Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Martfury - WooCommerce Marketplace WordPress Theme versions = 3.3.9...

WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Theme Grocery Shopping Store versions = 1.3.3...

WordPress Jannah theme <= 7.6.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Jannah versions = 7.6.5...

CVE-2025-4606

CVE-2025-4606 Panoramica Questo strumento viene utilizzato per testare la vulnerabilità CVE-2025-4606 su WordPress che utilizza il tema Sala – Tema WordPress per Startup e SaaS. Questa vulnerabilità consente Privilege Escalation tramite Account Takeover poiché il tema non esegue una corretta...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

GHSA-M382-6JW4-FMP6 Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...

GHSA-JJ74-HC2Q-XRVM Ghost: Remote Code Execution via Theme Translation Files

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...

Ghost: Remote Code Execution via Theme Translation Files

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...

EUVD-2026-92767

Ghost: Remote Code Execution via Theme Translation Files...

NPM: Ghost: Remote Code Execution via Theme Translation Files

NPM: Ghost: Remote Code Execution via Theme Translation Files vulnerability discovered by ? in WordPress Npm ghost versions = 6.10.3, 6.64.0...

CVE-2026-106509

A flaw was found in the Backstage plugin-techdocs-node package. When TechDocs is configured to build documentation locally or within a container, an authenticated user with write access to a registered repository can submit malicious configuration values within the MkDocs theme settings. This fla...

WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Uminex versions = 1.0.9...

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme DK versions = 3.2.1...

WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Pond versions = 2.6.1...

WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Neo | Barber Shop WordPress Theme versions = 3.5...

WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Werkstatt versions = 4.8.3...

WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Whistle - Sports Club theme = 4.2 - Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Whistle - Sports Club versions = 4.2...

WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Treck versions = 1.0.0...