CVE-2025-68510 WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through 7.7.5...

CVE-2025-67959 WordPress WorkScout theme <= 4.1.07 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through = 4.1.07...

CVE-2025-67959 WordPress WorkScout theme <= 4.1.07 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through = 4.1.07...

CVE-2025-67959

CVE-2025-67959 is a Reflected XSS in the WordPress WorkScout theme (versions up to 4.1.07). The vulnerability stems from improper input handling during web page generation. CVSS: 3.1 base 7.1 (HIGH), network access, no privileges, user interaction required; exploitation context is reflected XSS. ...

CVE-2025-67952 WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through 5.6.2...

CVE-2025-67952 WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through 5.6.2...

CVE-2025-67949

CVE-2025-67949 is a WordPress Hostiko theme

CVE-2025-67946 WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through = 6.0.11...

CVE-2025-67949 WordPress Hostiko theme < 94.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through 94.3.6...

CVE-2025-67946

CVE-2025-67946 affects the WordPress theme AdForest (AdForest: &lt;= 6.0.11). The issue is described as an improper control of the filename for include/require, leading to a Local File Inclusion (LFI) vulnerability (initial description mentions a PHP Remote File Inclusion context but the observab...

CVE-2025-67949 WordPress Hostiko theme < 94.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through 94.3.6...

CVE-2025-67946 WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through = 6.0.11...

CVE-2025-67941

CVE-2025-67941 refers to a Local File Inclusion in WordPress theme The Aisle by Elated-Themes, caused by improper control of filename for include/require statements in PHP. Affects The Aisle versions prior to 2.9.1. Impact is local file inclusion via PHP, enabling access to local files. Public ad...

CVE-2025-67940

CVE-2025-67940 — Mikado-Themes Powerlift Local File Inclusion (LFI) Description in sources confirms an improper control of filenames for include/require in the PHP code, enabling PHP Local File Inclusion via PHP Remote File Inclusion vectors. The vulnerability affects Powerlift versions before 3....

CVE-2025-67941 WordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Inclusion.This issue affects The Aisle: from n/a through 2.9.1...

CVE-2025-67940 WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through 3.2.1...

CVE-2025-67941 WordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Inclusion.This issue affects The Aisle: from n/a through 2.9.1...

CVE-2025-67620

CVE-2025-67620 — Reflected Cross-Site Scripting in CleverSoft Anon anon2x. The flaw arises from improper neutralization of input during web page generation, affecting Anon theme versions

CVE-2025-67619

CVE-2025-67619 describes a PHP object-injection via deserialization in the WordPress Kids Heaven theme (Kids Heaven: kids-world) for versions up to and including 3.2. Root cause: deserialization of untrusted data leading to object injection. Impact: high (per CVSS) across confidentiality, integri...

CVE-2025-67938

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inclusion.This issue affects Biagiotti: from n/a through 3.5.2...