EUVD-2026-102812

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

CVE-2026-89079

The Theme My Login plugin for WordPress (versions ≤ 7.2.1 ) is vulnerable to unauthenticated privilege escalation via account takeover. The root cause is the failure to properly validate a user's identity before updating their password, specifically when the tml_user_passwords network option is e...

EUVD-2026-102666

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

CVE-2026-89079 Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

CVE-2026-93535

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-93535 WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

EUVD-2026-102609

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-93535: Improper Neutralization of Input During Web Page Generation

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...

PT-2026-115520

Name of the Vulnerable Software and Affected Versions The Grid versions prior to 2.8.2 Description Improper control of code generation allows for command injection, leading to remote code execution. This occurs when the software fails to properly sanitize input used in the generation of code...

VulnCheck KEV: CVE-2026-94169

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

PT-2026-115462

Name of the Vulnerable Software and Affected Versions Theme My Login versions prior to 7.2.2 Description Theme My Login for WordPress contains a privilege escalation flaw that allows unauthenticated attackers to perform account takeovers. The issue occurs because the plugin fails to properly...

CVE-2026-89079: Improper Privilege Management

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

CVE-2026-111413: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8...

PT-2026-115605

Name of the Vulnerable Software and Affected Versions aThemeArt Theme Helper versions prior to 1.0.9 Description aThemeArt Theme Helper is subject to a Cross-Site Request Forgery CSRF flaw. This issue allows an attacker to induce a user to perform actions they did not intend to do by tricking the...

CVE-2026-94169: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - AdForest WordPress Authentication Bypass PoC Description Simple Proof of Concept for CVE-2026-1729 PoC - Authentication bypass vulnerability in AdForest WordPress Theme. Authored by f3ds cr3w est 2oo2 blog Features ✅ Direct admin access without credentials ✅ Works on production...

WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...

WPProbe Plugin Enumeration Tool 0.12.12

A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...

CVE-2026-103414

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...

EUVD-2026-101497

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...