CVE-2026-3211 Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1...

CVE-2026-3211 Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1...

CVE-2026-3211

The CVE-2026-3211 entry concerns Drupal Theme Negotiation by Rules, affecting versions prior to 1.2.1. The vulnerability is a Cross-Site Request Forgery (CSRF) that leverages the module’s ability to render pages with theme_rule configs. The root cause is exposure via a GET request that can enable...

Drupal Theme Negotiation by Rules 安全漏洞

Drupal Theme Negotiation by Rules is a content management system module developed by Drupal that dynamically selects website theme styles based on rules. Versions of Drupal Theme Negotiation by Rules prior to 1.2.1 contained security vulnerabilities, which were caused by susceptibility to...

PT-2026-27824

Name of the Vulnerable Software and Affected Versions ThemeREX Nelson versions n/a through 1.2.0 Description A flaw exists in ThemeREX Nelson due to improper control of filename handling for include/require statements in the PHP program, leading to a PHP Local File Inclusion issue. The...

PT-2026-27806

CVE-2025-69096 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zork… https://t.co/7vIIzsCyr0...

PT-2026-27981

Name of the Vulnerable Software and Affected Versions ThemeREX Love Story versions n/a through 1.3.12 Description An issue exists in ThemeREX Love Story that allows for object injection due to deserialization of untrusted data. This impacts the application's ability to securely handle data input...

PT-2026-28040

Name of the Vulnerable Software and Affected Versions VillaTheme Abandoned Cart Recovery for WooCommerce versions through 1.1.10 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Cross-site Scripting condition. This allows for...

PT-2026-27817

Name of the Vulnerable Software and Affected Versions ThemeREX Good Homes versions n/a through 1.3.13 Description The software contains a flaw due to improper control of filename handling for include/require statements in PHP. This allows for PHP Local File Inclusion. The affected component is th...

PT-2026-27827

Name of the Vulnerable Software and Affected Versions Elated-Themes Amoli versions through 1.0 Description A flaw exists in Elated-Themes Amoli that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue enables the inclusion of local...

PT-2026-27853

Name of the Vulnerable Software and Affected Versions The Grid versions prior to 2.8.0 Description An issue exists in The Grid that allows for Stored Cross-Site Scripting XSS. This occurs due to improper neutralization of input during web page generation. The vulnerability allows an attacker to...

PT-2026-27834

Name of the Vulnerable Software and Affected Versions AncoraThemes Triompher versions through 1.1.0 Description The software contains a flaw related to improper control of filename handling for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local...

PT-2026-27982

Name of the Vulnerable Software and Affected Versions ThemeREX Work & Travel Company versions through 1.2 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts the Work & Travel Company application. Recommendations...

PT-2026-28016

Name of the Vulnerable Software and Affected Versions Select-Themes Borgholm versions prior to 1.6 Description An issue exists in Select-Themes Borgholm borgholm-marketing-agency-theme related to the deserialization of untrusted data, which allows for object injection. This could potentially allo...

WordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Car Dealer versions = 1.6.7...

WordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Golo versions 1.7.5...

WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO in WordPress Theme Ona versions 1.24...

WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Apicona versions = 24.1.0...

WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Sanzo versions 2.4.3...

WordPress Vayvo - Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Vayvo - Media Streaming & Membership WordPress Theme theme 6.8 - Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Vayvo versions 6.8...