CVE-2026-27069

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through = 8.7.2...

CVE-2026-25459 WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through = 3.5.12...

CVE-2026-25459

CVE-2026-25459 affects the WordPress Sober theme (uixthemes Sober) prior to version 3.5.12, described as a Missing Authorization vulnerability due to incorrectly configured access control. Affected component is the Sober WordPress theme; root cause is broken/incorrect access controls enabling ins...

CVE-2026-25459 WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through = 3.5.12...

CVE-2026-25395

CVE-2026-25395 – WordPress Business Roy theme

CVE-2026-25395 WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through = 1.1.4...

CVE-2026-25393 WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through = 1.0.6...

CVE-2026-25394 WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through = 1.0.6...

CVE-2026-25393

CVE-2026-25393 is a Missing Authorization / Broken Access Control vulnerability affecting the WordPress Hello FSE theme (Hello FSE) up to version 1.0.6. The publicly available documents from NVD, Red Hat, Patchstack, CVE listings, and Wordfence identify an Incorrectly Configured Access Control Se...

CVE-2026-25394

CVE-2026-25394 describes a Missing Authorization / Broken Access Control in the WordPress Fitness FSE theme (versions ≤ 1.0.6). The vulnerability arises from incorrectly configured access control security levels, and affects Fitness FSE from n/a to 1.0.6. The connected sources (NVD, Red Hat, CVE ...

CVE-2026-25394 WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through = 1.0.6...

CVE-2026-25395 WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through = 1.1.4...

CVE-2026-25374

CVE-2026-25374 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress Spa and Salon theme (raratheme) prior to/including version 1.3.2. The issue is tied to misconfigured access control levels and allows unauthorized actions due to insufficient authorization chec...

CVE-2026-25374

Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through = 1.3.2...

CVE-2026-25374 WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through = 1.3.2...

CVE-2026-25367 WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through 3.7.2...

CVE-2026-25367

CVE-2026-25367 is a missing-authorization/broken access control vulnerability in the WordPress CitiLights theme by NooTheme (CitiLights

CVE-2026-25367 WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through 3.7.2...

CVE-2026-25337

The CVE-2026-25337 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Coachify theme (wpcoachify/Coachify) affecting versions up to and including 1.1.5. The issue is identified across multiple sources (NVD, Red Hat, CVE List, PatchStack, AttackERKB, VulnEnrichment)...

CVE-2026-25337 WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through = 1.1.5...