21828 matches found
EUVD-2026-96375
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4...
CVE-2026-94160
The ThemeStek Extras for LabtechCO Theme WordPress plugin (versions
CVE-2026-94160 WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4...
CVE-2026-17025
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-94160: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4...
CVE-2026-57806: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...
CVE-2026-81797: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
PT-2026-109742
Name of the Vulnerable Software and Affected Versions Martfury - WooCommerce Marketplace WordPress Theme versions prior to 3.3.10 Description The software contains a Reflected Cross-site Scripting XSS flaw, which occurs when an application includes untrusted data in a web page without proper...
PT-2026-109704
Name of the Vulnerable Software and Affected Versions ThemeStek Extras for LabtechCO Theme versions prior to 8.5 Description Improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS. This occurs when an application includes untrusted data in a web...
CVE-2026-17025: Improper Neutralization of Input During Web Page Generation
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
WordPress Graphene theme <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Theme Graphene versions = 2.9.4...
CVE-2026-94064
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...
EUVD-2026-95784
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...
CVE-2026-94064 WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...
CVE-2026-94064
The BuddhaThemes Neo | Barber Shop WordPress Theme (neocut) is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This vulnerability affects versions up to and including 3.5 . Successful exploitation can lead to significant impacts on confidentiality , inte...
BIT-GHOST-2026-104418 Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary...
BIT-GHOST-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...
BIT-GHOST-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass
Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...