CVE-2026-25367 WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through 3.7.2...

CVE-2026-25337

The CVE-2026-25337 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Coachify theme (wpcoachify/Coachify) affecting versions up to and including 1.1.5. The issue is identified across multiple sources (NVD, Red Hat, CVE List, PatchStack, AttackERKB, VulnEnrichment)...

CVE-2026-25337 WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through = 1.1.5...

CVE-2026-25337 WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through = 1.1.5...

CVE-2026-25333 WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in peregrinethemes Shopwell shopwell allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopwell: from n/a through = 1.0.11...

CVE-2026-25336 WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coachify: from n/a through = 1.1.5...

CVE-2026-25336 WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coachify: from n/a through = 1.1.5...

CVE-2026-25333 WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in peregrinethemes Shopwell shopwell allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopwell: from n/a through = 1.0.11...

CVE-2026-25333

CVE-2026-25333 affects the WordPress Shopwell theme (versions

CVE-2026-25006 WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through = 9.6.4...

CVE-2026-25305 WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through = 9.6.4...

CVE-2026-25305 WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through = 9.6.4...

CVE-2026-25305

The CVE CVE-2026-25305 concerns the 8theme WordPress XStore theme (xstore) with versions up to and including 9.6.4. It is a DOM-based Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects XStore and can lead to client-sid...

CVE-2026-25006

CVE-2026-25006 affects the WordPress XStore theme up to version 9.6.4. The Root Cause is improper neutralization of script-related HTML tags in a web page, enabling Code Injection via XStore’s shortcode handling. Affected product: XStore theme (WordPress). Impact: potential arbitrary shortcode ex...

CVE-2026-23544 WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through = 5.6.3.5...

CVE-2026-23544 WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through = 5.6.3.5...

CVE-2026-23544

CVE-2026-23544 is a Deserialization of Untrusted Data vulnerability in the Valenti WordPress theme (codetipi Valenti) affecting versions from n/a through 5.6.3.5. Public details in connected docs describe object injection via deserialization with a high impact (CVSS 3.1: 8.8). The Wordfence repor...

CVE-2026-23542 WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through = 7.0.10...

CVE-2026-23542

CVE-2026-23542 is a PHP Object Injection vulnerability in the WordPress theme “Grand Restaurant” (Theme Goods) 7.0.10) or follow vendor patch guidance. Other connected sources corroborate the vulnerability name and affected software. Technical details such as root cause specifics, exploit vector...

CVE-2025-12074

The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'contextblogmodalpopup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from passwor...