CVE-2026-104671

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...

CVE-2026-104671 TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...

WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Jacqueline versions = 2.22...

WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Qwery versions = 3.6.1...

WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Anesta versions = 1.5.3...

WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Gutentype versions = 2.1.12...

WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Convex versions = 1.16.0...

WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Dwell versions = 1.16.0...

WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Edema versions = 1.2.2.2...

WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Hygia versions = 1.21.0...

WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Partiso versions = 1.1.13...

WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Rosalinda versions = 1.2.4...

WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Theme Buzz Stone | Magazine & Viral Blog WordPress Theme versions = 1.0.2...

WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme LMS versions = 8.3...

WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Baikuya in WordPress Theme Motors versions = 1.4.108...

WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Martfury - WooCommerce Marketplace WordPress theme theme = 3.3.9 - Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Martfury - WooCommerce Marketplace WordPress Theme versions = 3.3.9...

WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Theme Grocery Shopping Store versions = 1.3.3...

WordPress Jannah theme <= 7.6.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Jannah versions = 7.6.5...

GHSA-M382-6JW4-FMP6 Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...

GHSA-JJ74-HC2Q-XRVM Ghost: Remote Code Execution via Theme Translation Files

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...