CVE-2026-25360

CVE-2026-25360 corresponds to a Deserialization of Untrusted Data vulnerability in the Vex plugin by Vex (Vex) for WordPress. Affected product: Vex = 1.2.9). Connected Wordfence details also list the CVE-2026-25360 under the Wordfence vulnerability repository with the same patched status and attr...

CVE-2026-25359

CVE-2026-25359 describes a Deserialization of Untrusted Data vulnerability in the Pendulum theme for WordPress, allowing PHP Object Injection. Affected software: Pendulum from no public earliest version up to

CVE-2026-25353 WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through 1.5.1...

CVE-2026-25356 WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through 1.6.7...

CVE-2026-25353 WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through 1.5.1...

CVE-2026-25355 WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through 2.4.3...

CVE-2026-25353

CVE-2026-25353 is a Reflected XSS vulnerability in the Nooni WordPress theme (Nooni). The issue is described as improper neutralization of input during web page generation and is reported as affecting Nooni versions from n/a up to (but not including) 1.5.1. The connected Wordfence document confir...

CVE-2026-25358

The CVE-2026-25358 entry covers a PHP object-injection vulnerability in the WordPress Meloo theme, affecting Meloo versions prior to 2.8.2. Root cause: deserialization of untrusted data could lead to object injection. Impact as stated includes high confidentiality, integrity, and availability con...

CVE-2026-25355

The CVE affects WordPress Sanzo theme versions prior to 2.4.3. Root cause: improper neutralization of input during web page generation, enabling stored cross-site scripting (XSS) in Sanzo pages. Impact is characterized as stored XSS with a CVSS v3.1 base score of 6.5 (MEDIUM): network attack comp...

CVE-2026-25356

The CVE-2026-25356 entry affects WordPress/Yobazar theme versions prior to 1.6.7, with a Reflected Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation. The issue enables an attacker to inject scripts that execute in other users’ browsers, aligning wi...

CVE-2026-25354 WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through 1.4.8...

CVE-2026-25356 WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through 1.6.7...

CVE-2026-25354

CVE-2026-25354 affects the WordPress Reebox theme (versions prior to 1.4.8). The Root Cause is improper neutralization of input during web page generation, resulting in a Reflected XSS vulnerability. Impact per sources is that arbitrary scripts can be injected into web pages when a user visits a ...

CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through 2.8.2...

CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through 2.8.2...

CVE-2026-25355 WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through 2.4.3...

CVE-2026-25350 WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through 1.5.3...

CVE-2026-25349

CVE-2026-25349 is a Reflected XSS in the Loobek WordPress theme (Loobek) affecting versions from n/a up to before 1.5.2. The CVE is rated with a CVSSv3.1 base score of 7.1 (HIGH), indicating network-attackable, low complexity, with no privileges required and user interaction required. The Wordfen...

CVE-2026-25352 WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through 1.5.9...

CVE-2026-25351 WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through 1.7.7...