EUVD-2025-210641

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Theme My Login versions = 7.1.14...

CVE-2026-70593

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

NPM: Ghost: Theme Upload Path Traversal

NPM: Ghost: Theme Upload Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

Ghost: Theme Upload Path Traversal

Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for thi...

GHSA-CJC9-Q5GF-327P Ghost: Theme Upload Path Traversal

Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for thi...

CVE-2026-70593

CVE-2026-70593 affects Ghost (Node.js) versions 0.10.0–6.54.1. A vulnerability in custom themes allows a staff user to write files outside the uploads directory via path traversal in LocalStorageBase and theme storage name handling, enabling modification of installation behavior. The issue is fix...

CVE-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

CVE-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

Malicious code in @nebula.js/theme (npm)

npm/@nebula.js/theme is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

MAL-2026-11933 Malicious code in @servicetitan/thoughtspot-theme (npm)

npm/@servicetitan/thoughtspot-theme is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11882 Malicious code in @servicetitan/kendo-theme (npm)

npm/@servicetitan/kendo-theme is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/kendo-theme (npm)

npm/@servicetitan/kendo-theme is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714

Misskey web client (versions 8.63.0 and later prior to 2026.5.4) is vulnerable to a DoS caused by a malformed theme triggering uncontrolled recursion during theme compilation, which can slow or crash the client. The issue is fixed in version 2026.5.4. Remediation is to upgrade to 2026.5.4 or late...

CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-12586

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...