WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Theme IT Residence versions = 3.2.1...

WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Theme Smart Cleaning versions = 4.8.6...

WordPress Warehouse Cargo theme <= 2.7.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Theme Warehouse Cargo versions = 2.7.0...

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...

PT-2026-78976

Name of the Vulnerable Software and Affected Versions Flatastic versions prior to 2.1 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects and...

PT-2026-78970

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Shuffle versions = 1.8...

WordPress Spectra theme <= 2.6.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Spectra versions = 2.6.1...

CVE-2026-73387

Unauthenticated Local File Inclusion in Resido = 1.5 versions...

EUVD-2026-62388

Unauthenticated Local File Inclusion in Resido = 1.5 versions...

WordPress MedXtore – Responsive Multipurpose Elementor WooCommerce WordPress Theme theme <= 3.3.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Phat RiO in WordPress Theme MedXtore – Responsive Multipurpose Elementor WooCommerce WordPress Theme versions = 3.3.4...

WordPress KidXtore - Kids Clothing and Toys Store Elementor WooCommerce WordPress Theme theme <= 2.7 - Local File Inclusion vulnerability

WordPress KidXtore - Kids Clothing and Toys Store Elementor WooCommerce WordPress Theme theme = 2.7 - Local File Inclusion vulnerability discovered by Phat RiO in WordPress Theme KidXtore - Kids Clothing and Toys Store Elementor WooCommerce WordPress Theme versions = 2.7...

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme theme <= 2.4 - Cross Site Scripting (XSS) vulnerability

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme theme = 2.4 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Valen - Sport, Fashion WooCommerce WordPress Theme versions = 2.4...

WordPress MBStore - Digital WooCommerce WordPress Theme theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

WordPress MBStore - Digital WooCommerce WordPress Theme theme = 2.3 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme MBStore - Digital WooCommerce WordPress Theme versions = 2.3...

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme theme = 2.3 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme BodyCenter - Gym, Fitness WooCommerce WordPress Theme versions = 2.3...

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Theme TheGem Elementor versions = 5.12.3...

CVE-2026-13712: Improper Neutralization of Input During Web Page Generation

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

PT-2026-73117

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

CVE-2026-28154

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...