2219 matches found
mTheme Unus < 2.3 - Directory Traversal
The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...
WordPress Jannah Theme <5.4.5 - Cross-Site Scripting
WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. id: CVE-2021-24407 info: name: WordPress Jannah Theme 5.4.5 - Cross-Site Scripting author: pikpikcu severity:...
CVE-2026-28154
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
EUVD-2026-58084
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-66691
Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...
CVE-2026-66653 WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...
CVE-2026-66465
CVE-2026-66465 affects WordPress Cartify theme (Cartify Multipurpose) versions up to and including 1.3.0.1, with unauthenticated broken authentication that can lead to account takeover. The connected documents confirm the vulnerability type and the affected version range but do not provide remedi...
CVE-2026-65582
CVE-2026-65582 affects the WordPress AI Hub theme (versions <= 1.3.10). The available documents describe a Subscriber Arbitrary File Download vulnerability in AI Hub
CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-65580
Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...
PT-2026-71583
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
WordPress M.Anh theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme M.Anh versions = 1.7...
WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Account Takeover vulnerability discovered by Denver Jackson in WordPress Theme Cartify versions = 1.3.0.1...
CVE-2026-66681
Theme My Login WordPress plugin
CVE-2026-65581 WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-65575 WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...