EUVD-2026-55098

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21073

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21073

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21073

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21073

CVE-2026-21073 affects Galaxy Themes prior to the SMR Aug-2026 Release 1. Description: improper input validation could allow a physical attacker to launch arbitrary activity. CVSS v4.0 score is 5.2 (Medium) with Attack Vector: Physical, Attack Complexity: Low, Privileges Required: None, User Inte...

CVE-2026-21073: Undefined Security Weakness

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

PT-2026-69401

Name of the Vulnerable Software and Affected Versions Galaxy Themes versions prior to SMR Aug-2026 Release 1 Description Improper input validation allows physical attackers to launch arbitrary activity. Recommendations Update Galaxy Themes to SMR Aug-2026 Release 1...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

MAL-2026-12851 Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

CVE-2026-70593

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

EUVD-2026-52977

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

PT-2026-67918

Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for thi...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Last week, there were 264 vulnerabilities disclosed in 210 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 117 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Cherry Framework <= 3.1.4 - Unauthenticated Backup Download

Description The theme does not restrict access to a backup script in its data management module, allowing unauthenticated attackers to download an archive of the site's themes directory, disclosing its source and any sensitive data stored within it...

Malicious Package

Overview bigops-ui-themes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)

Last week, there were 91 vulnerabilities disclosed in WordPress Core, 80 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 62 Vulnerability Researchers that contributed to WordPress Security last week. Review those...

EUVD-2026-48094

Author Cross Site Scripting XSS in HashThemes Demo Importer = 1.4.2 versions...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026)

Last week, there were 311 vulnerabilities disclosed in 254 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 167 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...