CVE-2026-27386

Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through = 1.8...

CVE-2026-27335

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Ekoterra - NonProfit, Green Energy & Ecology Theme ekoterra allows PHP Local File Inclusion.This issue affects Ekoterra - NonProfit, Green Energy & Ecology Theme: fr...

CVE-2026-22410 WordPress Dolcino theme <= 1.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Dolcino dolcino allows PHP Local File Inclusion.This issue affects Dolcino: from n/a through = 1.6...

CVE-2026-22414 WordPress Marra theme <= 1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Marra marra allows PHP Local File Inclusion.This issue affects Marra: from n/a through = 1.2...

CVE-2026-22408

CVE-2026-22408 is a Local File Inclusion vulnerability affecting Mikado-Themes Justicia WordPress theme (and Justicia plugin entry) up to version 1.2. The root cause is improper control of filename for include/require statements, enabling PHP Local File Inclusion. The CVE entry notes impact as hi...

CVE-2026-22397 WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Fleur fleur allows PHP Local File Inclusion.This issue affects Fleur: from n/a through = 2.2.1...

CVE-2026-22397 WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Fleur fleur allows PHP Local File Inclusion.This issue affects Fleur: from n/a through = 2.2.1...

CVE-2026-29053 Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1...

CVE-2026-29053 Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1...

CVE-2026-29053

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1...

CVE-2026-29053

Ghost CMS CVE-2026-29053 affects Ghost 0.7.2–6.19.0, with a server-side code execution via malicious themes. The root cause is an unsafe Handlebars/jsonpath flow: the get helper could traverse the prototype chain, allowing a theme to execute arbitrary code on the server. The issue is fixed in Gho...

CVE-2026-29053 Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1...

PT-2026-23150

Name of the Vulnerable Software and Affected Versions Mikado-Themes Aviana versions through 2.1 Description A flaw exists in Mikado-Themes Aviana that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to PHP Remote File...

PT-2026-23198

Name of the Vulnerable Software and Affected Versions Elated-Themes Askka versions through 1.0 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local fil...

PT-2026-23183

Name of the Vulnerable Software and Affected Versions Elated-Themes Helvig versions through 1.0 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local...

PT-2026-23166

Name of the Vulnerable Software and Affected Versions FixTeam versions through 1.4 Description A flaw exists in FixTeam that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a 'PHP Remote File Inclusion' condition...

PT-2026-23146

Name of the Vulnerable Software and Affected Versions BuddhaThemes WeDesignTech Ultimate Booking Addon versions through 1.0.3 Description An authorization issue exists in the WeDesignTech Ultimate Booking Addon, allowing exploitation due to incorrectly configured access control security levels...

PT-2026-23176

Name of the Vulnerable Software and Affected Versions AncoraThemes Tooth Fairy versions through 1.16 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File...

PT-2026-23263

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through = 1.0.1...

PT-2026-23157

Name of the Vulnerable Software and Affected Versions Mikado-Themes Holmes versions through 1.7 Description A flaw exists in Mikado-Themes Holmes that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remote File...