CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-84815

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Kriesi Enfold WordPress theme, affecting versions 8.0 and earlier . The flaw stems from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in a victim's brows...

CVE-2026-84815 WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0...

CVE-2026-84815 WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0...

CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

EUVD-2026-70362

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability

Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...

WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Enfold versions = 8.0...

PT-2026-84919

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skype url shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skype url field is not included in the $url optio...

CVE-2026-3852: Improper Neutralization of Input During Web Page Generation

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

WordPress Divi theme <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions = 4.27.6...

io.jenkins.plugins:design-library (>=444.v568b_174ece88, <=483.v401c307fdd1b), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +5 more potentially affected by CVE-2026-84655 via org.kohsuke.stapler:stapler (>=2092.v91b_2c63e0c97, <=2107.v8dfcb_e8ed317)

org.kohsuke.stapler:stapler MAVEN version =2092.v91b2c63e0c97, =444.v568b174ece88, =2.569, =2.569, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2107.v8dfcbe8ed317 Source cves: CVE-2026-84655 Source advisory: MEND:CVE-2026-84655...

io.jenkins.plugins:design-library (>=444.v568b_174ece88, <=483.v401c307fdd1b), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +1 more potentially affected by CVE-2026-84650 via org.jenkins-ci.main:jenkins-core (>=2.569, <=2.579)

org.jenkins-ci.main:jenkins-core MAVEN version =2.569, =444.v568b174ece88, =2.569, =2.579 Source cves: CVE-2026-84650 Source advisory: MEND:CVE-2026-84650...

io.jenkins.plugins:design-library (>=444.v568b_174ece88, <=483.v401c307fdd1b), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +5 more potentially affected by CVE-2026-84649 via org.kohsuke.stapler:stapler (>=2092.v91b_2c63e0c97, <=2107.v8dfcb_e8ed317)

org.kohsuke.stapler:stapler MAVEN version =2092.v91b2c63e0c97, =444.v568b174ece88, =2.569, =2.569, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2107.v8dfcbe8ed317 Source cves: CVE-2026-84649 Source advisory: MEND:CVE-2026-84649...

CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

CVE-2026-66652

CVE-2026-66652 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeGoods Grand Tour WordPress theme, affecting versions from an unspecified start through 5.5.1 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with a network attack vector, low complexity, no required privileges, re...

CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Tour versions = 5.5.1...

Malicious Package

Overview arif-ronde76-sukiwir is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...