CVE-2026-28045 WordPress N7 | Golf Club Sports & Events theme <= 2.16.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX N7 | Golf Club Sports & Events n7-golf-club allows PHP Local File Inclusion.This issue affects N7 | Golf Club Sports & Events: from n/a through = 2.16.0...

CVE-2026-28046

CVE-2026-28046 is a Local File Inclusion vulnerability in the WordPress WordPress Law Office theme (ThemeREX Law Office) affecting versions up to 3.3.0. The issue stems from improper control of filenames in PHP include/require, enabling potential local file access via a network-exposed vector. Th...

CVE-2026-28026

CVE-2026-28026 corresponds to a Local File Inclusion (LFI) in ThemeREX Motorix (WordPress/Motorix theme) due to improper control of the filename in PHP include/require statements. Affected: Motorix versions up to and including 1.6 (notation:

CVE-2026-28021 WordPress Craftis theme <= 1.2.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Craftis craftis allows PHP Local File Inclusion.This issue affects Craftis: from n/a through = 1.2.8...

CVE-2026-28018 WordPress Global Logistics theme <= 3.20 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through = 3.20...

CVE-2026-28013 WordPress Kratz theme <= 1.0.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Kratz kratz allows PHP Local File Inclusion.This issue affects Kratz: from n/a through = 1.0.12...

CVE-2026-27992 WordPress Meals & Wheels theme <= 1.1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Meals & Wheels meals-wheels allows PHP Local File Inclusion.This issue affects Meals & Wheels: from n/a through = 1.1.12...

CVE-2026-27989 WordPress Quanzo theme <= 1.0.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Quanzo quanzo allows PHP Local File Inclusion.This issue affects Quanzo: from n/a through = 1.0.10...

CVE-2026-27987

CVE-2026-27987 concerns WordPress ThemeREX The Qlean (the-qlean)

CVE-2026-27987 WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX The Qlean the-qlean allows PHP Local File Inclusion.This issue affects The Qlean: from n/a through = 2.12...

CVE-2026-27987 WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX The Qlean the-qlean allows PHP Local File Inclusion.This issue affects The Qlean: from n/a through = 2.12...

CVE-2026-27986

CVE-2026-27986 is a Local File Inclusion (LFI) vulnerability in the WordPress ThemeOsTende OSTende by ThemeREX. Affected: OsTende versions up to and including 1.4.3. Root cause: improper filename handling for PHP include/require statements (PHP Remote File Inclusion risk turned into Local File In...

CVE-2026-27437

CVE-2026-27437 is a PHP Object Injection vulnerability in the ThemeREX Tennis Club WordPress theme (tennis-sportclub), arising from deserialization of untrusted data that enables object injection. Public records in NVD, Red Hat, CVE listings, and PatchStack describe it as deserialization-based, a...

CVE-2026-27383 WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through = 2.13...

CVE-2026-27383

CVE-2026-27383 affects RadiusTheme Metro WordPress theme (

CVE-2026-27381 WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through = 1.3.15...

CVE-2026-27376

CVE-2026-27376 is a Reflected Cross‑Site Scripting vulnerability in the Claue theme (JanStudio Claue) for WordPress. It affects Claue – Clean, Minimal Elementor WooCommerce Theme versions from n/a through ≤ 2.2.7. The issue arises from improper neutralization of input during web page generation. ...

CVE-2026-27352

CVE-2026-27352 affects ThemeGoods Starto (WordPress Starto theme). The vulnerability is a Reflected XSS due to improper input neutralization during web page generation. Affected versions are Starto from before 2.2.5 (i.e., impacted until 2.2.4). The CVSS 3.1 vector indicates Network attack, no pr...

CVE-2026-27353 WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through = 3.4.3...

CVE-2026-27353 WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through = 3.4.3...