CVE-2026-105676 Ghost: Path Traversal via Locale Setting

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

CVE-2026-105676 Ghost: Path Traversal via Locale Setting

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

WordPress JobZilla - Job Board WordPress Theme theme = 2.2 - Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Theme JobZilla - Job Board WordPress Theme versions = 2.2...

WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

WordPress Porto Theme - Functionality plugin = 3.9.3 - SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Porto Theme - Functionality versions = 3.9.3...

CVE-2026-105293

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293

Legcord versions 1.1.0 through 1.3.0 are vulnerable to a path traversal vulnerability within the theme IPC handlers. The root cause is the use of unvalidated theme ids , which allows scripts running in the Discord origin (e.g., via XSS ) to escape the designated themes directory. Attackers can ab...

EUVD-2026-92157

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

PT-2026-106188

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.0 through 6.63.0 Description An issue in the way theme translation files are loaded allows an authenticated Administrator to read JSON files located outside of the active theme directory, which could lead to the exposure of...

CVE-2026-105677: Improper Limitation of a Pathname to a Restricted Directory

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...

PT-2026-106196

Name of the Vulnerable Software and Affected Versions Ghost versions 6.10.3 through 6.63.0 Description An issue in the way the system loads theme translation files allows an authenticated Administrator to execute arbitrary code on the server by using a crafted theme. Recommendations Update to...

CVE-2026-105293: Improper Limitation of a Pathname to a Restricted Directory

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

PT-2026-104667

Name of the Vulnerable Software and Affected Versions Legcord versions 1.1.0 through 1.3.0 Description Path traversal exists in theme IPC handlers, allowing scripts running in the Discord origin, such as through Cross-Site Scripting XSS, to escape the themes directory. This occurs due to...

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Denver Jackson in WordPress Theme Haaken versions = 1.5...

WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Restaurant versions 7.0.11...

[SECURITY] Fedora 45 Update: pocillo-gtk-theme-0.13.0-1.fc45

Pocillo is a Material Design theme for the Budgie Desktop...

wordpress-rce-theme-editor-webshell-injection

WordPress RCE - Inyeccion de Webshell via Editor de Temas...

CVE-2026-104418

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary...

CVE-2026-104417

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-104418 Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary...