CVE-2026-39578

CVE-2026-39578 refers to an unauthenticated PHP Object Injection in WordPress Theme Valiance versions

CVE-2026-39554

CVE-2026-39554 concerns WordPress Theme Fidalgo (versions

CVE-2026-27429 WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...

CVE-2026-12256

The CVE concerns WordPress sites using the Avada theme ≤ 3.15.3, where a PHP Object Injection vulnerability exists in the Contributor component. The issue is triggered remotely over the network (attack vector: NETWORK, low complexity, required privileges: LOW, no user interaction). The impact is ...

CVE-2025-69160

CVE-2025-69160 : Unauthenticated Local File Inclusion in WordPress Gita theme

CVE-2025-69159 WordPress Printo theme <= 1.11 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Printo = 1.11 versions...

CVE-2025-69151 WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...

CVE-2025-69149

Technical details about CVE-2025-69149 (Top Dog theme LFI) are not publicly provided in the supplied documents. Please monitor official advisories and vendor patches for affected versions.

CVE-2025-69131

Affected software: WordPress & WooCommerce Scraper Plugin, Import Data from Any Site (WordPress). Vulnerability: Unauthenticated Arbitrary File Download in versions

CVE-2025-69121 WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Deliciosa = 1.10.0 versions...

CVE-2025-69116 WordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Iona = 1.0.8 versions...

CVE-2025-69114 WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in MaxiNet = 1.2.10 versions...

CVE-2025-69112

Technical details for CVE-2025-69112 (Planty WordPress theme

CVE-2025-69109

Technical details for CVE-2025-69109 are not provided in the supplied documents. No affected versions, root cause, impact, or remediation are stated here. Monitor for updates from the connected sources.

CVE-2025-69104 WordPress Qreatix theme <= 1.9.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Qreatix = 1.9.4 versions...

CVE-2025-58924 WordPress Geya theme <= 1.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Geya = 1.15 versions...

CVE-2025-58924

Technical details for CVE-2025-58924 are not provided in the supplied documents. No specifics on affected versions beyond 

CVE-2026-39490

Unauthenticated Broken Access Control in JupiterX Core = 4.14.1 versions...

EUVD-2026-37052

Unauthenticated Broken Access Control in Envira Photo Gallery = 1.12.5 versions...

EUVD-2026-37050

Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO = 12.4.16 versions...