CVE-2026-25380 WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in jwsthemes Feedy feedy allows PHP Local File Inclusion.This issue affects Feedy: from n/a through 2.1.5...

CVE-2026-25379 WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through 6.8.6...

CVE-2026-25360

CVE-2026-25360 corresponds to a Deserialization of Untrusted Data vulnerability in the Vex plugin by Vex (Vex) for WordPress. Affected product: Vex = 1.2.9). Connected Wordfence details also list the CVE-2026-25360 under the Wordfence vulnerability repository with the same patched status and attr...

CVE-2026-25360 WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through 1.2.9...

CVE-2026-25360 WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through 1.2.9...

CVE-2026-25359 WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through 3.1.5...

CVE-2026-25359

CVE-2026-25359 describes a Deserialization of Untrusted Data vulnerability in the Pendulum theme for WordPress, allowing PHP Object Injection. Affected software: Pendulum from no public earliest version up to

CVE-2026-25353 WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through 1.5.1...

CVE-2026-25355

The CVE affects WordPress Sanzo theme versions prior to 2.4.3. Root cause: improper neutralization of input during web page generation, enabling stored cross-site scripting (XSS) in Sanzo pages. Impact is characterized as stored XSS with a CVSS v3.1 base score of 6.5 (MEDIUM): network attack comp...

CVE-2026-25355 WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through 2.4.3...

CVE-2026-25353

CVE-2026-25353 is a Reflected XSS vulnerability in the Nooni WordPress theme (Nooni). The issue is described as improper neutralization of input during web page generation and is reported as affecting Nooni versions from n/a up to (but not including) 1.5.1. The connected Wordfence document confir...

CVE-2026-25358

The CVE-2026-25358 entry covers a PHP object-injection vulnerability in the WordPress Meloo theme, affecting Meloo versions prior to 2.8.2. Root cause: deserialization of untrusted data could lead to object injection. Impact as stated includes high confidentiality, integrity, and availability con...

CVE-2026-25356 WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through 1.6.7...

CVE-2026-25353 WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through 1.5.1...

CVE-2026-25354 WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through 1.4.8...

CVE-2026-25356

The CVE-2026-25356 entry affects WordPress/Yobazar theme versions prior to 1.6.7, with a Reflected Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation. The issue enables an attacker to inject scripts that execute in other users’ browsers, aligning wi...

CVE-2026-25356 WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through 1.6.7...

CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through 2.8.2...

CVE-2026-25355 WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through 2.4.3...

CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through 2.8.2...