CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

WordPress Avada Theme <= 7.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Theme Avada versions = 7.16...

EUVD-2026-66334

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2026-6178

The Betheme WordPress theme (all versions up to and including 28.4 ) is vulnerable to stored cross-site scripting via the 'icon_box_2' shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, allowing any authenticated user with contributor-lev...

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...

CVE-2026-79773

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

EUVD-2026-65531

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

CVE-2026-79773

Winter CMS before 1.2.13 is affected by a local file inclusion vulnerability in the JavascriptImporter filter . Authenticated users holding the cms.manage_assets permission can embed =include or =require directives in theme JavaScript assets, referencing files outside the theme directory (e.g., ....

CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78566 Shuffle <= 1.8 - Unauthenticated Local File Inclusion

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.8 . An unauthenticated attacker over the network can include and execute arbitrary files on the server, enabling execution of any PHP code contained in those files. This may be used to bypa...

Blackash-CVE-2025-4322

CVE-2025-4322 : Escalation dei Privilegi non Autenticata tramite Aggiornamento Password "Account Takeover 🔥" Descrizione : Il tema Motors per WordPress è vulnerabile all'escalation dei privilegi tramite account takeover in tutte le versioni fino alla 5.6.67 inclusa. Ciò è dovuto al fatto che il...