CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khuong Hai & Thanh Nam HPT Vietnam in WordPress Theme Urna versions = 2.6.2...

WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jawn versions = 1.4.2...

CVE-2026-66672

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66612

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Koji = 2.2.1 versions...

CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66647

CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...

CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

EUVD-2026-63297

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

CVE-2025-15689 WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

CVE-2025-15637 WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

CVE-2026-74021 WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Tonda versions 2.6...

WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Måne versions = 1.7...