WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Broken Access Control vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

PT-2026-63927

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65522: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65511: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65500: Missing Authorization

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

PT-2026-63934

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

PT-2026-63921

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Theme Photography versions = 7.7.6...

WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Vino versions = 1.9...

WordPress TheGem theme <= 5.11.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme TheGem versions = 5.11.1...

WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Civi versions = 2.2.4...

WordPress PIMP - Creative MultiPurpose theme <= 1.7 - Cross Site Request Forgery (CSRF) vulnerability

WordPress PIMP - Creative MultiPurpose theme = 1.7 - Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme PIMP - Creative MultiPurpose versions = 1.7...

Malicious code in sphinx-rtd-theme-cilium (PyPI)

--- Credit: OpenSSF source...

Malicious code in sphinx-rdt-theme (PyPI)

Source: kam193 8397635bb7a7130efa3b0f3b924fbb3b61c66ab82baedef14452ded787f4e00a A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the username to the package author. There is no other purpose...

WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Photography versions = 5.7.8...

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-60137: Improper Neutralization of Special Elements used in an SQL Command

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-44767

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...