PT-2026-55026

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme = 3.2.8 versions...

PT-2026-54967

Name of the Vulnerable Software and Affected Versions SpaLab Beauty Salon WordPress Theme versions 6.7 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, allowing attackers to execute malicious scripts in the browser of other users without requiring prior...

PT-2026-54969

Unauthenticated Cross Site Scripting XSS in Kids Zone - Children WordPress Theme = 5.4 versions...

CVE-2026-57685: Missing Authorization

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme = 3.2.8 versions...

CVE-2025-69156: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kids Zone - Children WordPress Theme = 5.4 versions...

CVE-2025-69154: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SpaLab | Beauty Salon WordPress Theme = 6.7 versions...

CVE-2026-10077: Undefined Security Weakness

The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wpksespost, as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any us...

CVE-2025-69155: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Fitness Zone WordPress Theme = 5.7 versions...

WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Artale | Wedding Photography WordPress versions = 2.2.2...

WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Automotive Car Dealership Business versions = 13.3.3...

boxmoe-dove-sqli-cve

CVE-2026-XXXXX Unauthenticated SQL Injection in Boxmoe Dov...

sakura-theme-sqli-cve

CVE-2026-XXXXX Unauthenticated SQL Injection in Sakura Wor...

EUVD-2025-210358

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey = 4.4.3 versions...

CVE-2025-68063

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey = 4.4.3 versions...

CVE-2025-68063 WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey = 4.4.3 versions...

CVE-2025-68063 WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey = 4.4.3 versions...

CVE-2025-68063

CVE-2025-68063 describes a Local File Inclusion flaw in the WordPress Splash – Sport Club WordPress Theme for Basketball, Football, Hockey, affecting versions

PT-2026-52716

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey = 4.4.3 versions...

CVE-2025-68063: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey = 4.4.3 versions...

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 15, 2026 to June 21, 2026)

Last week, there were 168 vulnerabilities disclosed in 146 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 96 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities...