21827 matches found
CVE-2026-103414
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...
DRUPAL-CONTRIB-2026-219
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that ...
CVE-2026-103414: Out-of-bounds Write
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...
BIT-GHOST-2026-105677 Ghost: Remote Code Execution via Theme Translation Files
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...
BIT-GHOST-2026-105676 Ghost: Path Traversal via Locale Setting
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...
CVE-2026-54870
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...
CVE-2026-54870 WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...
EUVD-2026-98295
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...
CVE-2026-54870
The Weaver Xtreme Theme Support plugin (weaverx-theme-support) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions n/a through 7.0.1 . The root cause is the improper neutralization of input during web page generation . This vulnerability allows an attacker to execute mali...
WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Weaver Xtreme Theme Support versions = 7.1...
VulnCheck KEV: CVE-2023-51501
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a through 2.8.6...
VulnCheck KEV: CVE-2024-2347
The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...
VulnCheck KEV: CVE-2026-3326
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
PT-2026-111353
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...
CVE-2026-54870: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...
CVE-2026-109596
Hugo versions v0.162.0 before v0.167.0 are vulnerable to an improper link resolution vulnerability (CWE-59). This flaw allows malicious themes or modules to perform symlink file disclosure by placing a symlink or NTFS junction at a virtual ancestor directory. During the build process, the resourc...
CVE-2026-109167 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey,...
WordPress Marin theme <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Theme Marin versions = 0.1.1...
CVE-2026-108913
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into /.local/state/omarchy/current/theme may include executable content from an untrusted Git repository...
CVE-2026-108913
The omarchy-theme-set component in Omarchy 4 (versions before 4.0.1 ) is vulnerable to code execution . This issue arises because the application allows files placed into ~/.local/state/omarchy/current/theme to include executable content from an untrusted Git repository, leading to the inclusion ...