CVE-2026-15326: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploi...

PT-2026-57101

The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator emai...

Avada < 3.15.4 - Authenticated (Contributor+) PHP Object Injection

Description The Avada theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.15.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain ...

WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme 777 versions = 1.13.0...

CVE-2026-4275: Cross-Site Request Forgery (CSRF)

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of 'returntrue' as the permissioncallback for the /installplugin and /activateplugin REST API endpoint...

WPProbe Plugin Enumeration Tool 0.12.5

A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...

github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Theme Open Shop versions = 1.7.1...

WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Theme Coaching versions = 3.9.2...

MAL-2026-6942 Malicious code in some-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97420170b95f54c404226b47901bbd45ec03ed0a427369b50add75297a2dcb80 Package [email protected] was scanned across 2 files with no a static rule matches and no behavioral findings. No install-time lifecycle execution, n...

Malicious code in some-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97420170b95f54c404226b47901bbd45ec03ed0a427369b50add75297a2dcb80 Package [email protected] was scanned across 2 files with no a static rule matches and no behavioral findings. No install-time lifecycle execution, n...

Malware in some-theme

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview some-theme is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in @gpbw-fcop-ui-packages/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7071 Malicious code in @gpbw-fcop-ui-packages/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @combinezone/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7062 Malicious code in @combinezone/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Theme Jobmonster versions = 4.8.5...

NativeChurch <= 4.8.8.2 - Reflected Cross-Site Scripting

Description The NativeChurch theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

WordPress Bricks Builder Theme - RCE

Exploit Title: WordPress Bricks Builder Theme - RCE Date: 2026-06-25 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://bricksbuilder.io/ Software Link: https://bricksbuilder.io/ Version: Bricks Builder Hello, Friend!" print"" h...