CVE-2026-78478: Improper Control of Filename for Include/Require Statement in PHP Program

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...

PT-2026-81219

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

PT-2026-81177

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.4.3 Description An issue exists that allows unauthenticated attackers to elevate their privileges to those of an administrator. Recommendations Update Jawn to a version newer than 1.4.2...

CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-66670 WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Måne = 1.7 versions...

CVE-2026-66670 WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Måne = 1.7 versions...

CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-66648 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...

CVE-2026-66648 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...

CVE-2026-66610 WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...

CVE-2026-66610 WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...

CVE-2026-28151 WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Tonda 2.6 versions...

CVE-2026-28151 WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Tonda 2.6 versions...

WPProbe Plugin Enumeration Tool 0.12.9

A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...

WordPress Greenshift – animation and page builder blocks plugin <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification vulnerability

Authenticated Contributor+ Theme Settings Modification vulnerability discovered by Raihan Adi Arba in WordPress Plugin Greenshift versions = 12.8.9...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

PT-2026-79553

Name of the Vulnerable Software and Affected Versions GreenShift – Animation and Page Builder Blocks versions prior to 12.9.0 Description The GreenShift – Animation and Page Builder Blocks plugin for WordPress allows unauthorized modification of data. The issue stems from a missing capability che...

WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khuong Hai & Thanh Nam HPT Vietnam in WordPress Theme Urna versions = 2.6.2...