CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

CVE-2026-66652

CVE-2026-66652 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeGoods Grand Tour WordPress theme, affecting versions from an unspecified start through 5.5.1 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with a network attack vector, low complexity, no required privileges, re...

CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Tour versions = 5.5.1...

WordPress Mane theme <= 1.7 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Theme Måne versions = 1.7...

CVE-2026-3851 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-18550

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550

The Nokri - Job Board WordPress Theme (versions ≤ 1.6.6 ) is vulnerable to unauthenticated privilege escalation via account takeover. The root cause is insufficient reset token validation in the nokri_reset_password() function: an empty attacker-supplied reset token matches empty or unset sb_pass...

EUVD-2026-69021

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

WordPress Nokri - Job Board WordPress Theme plugin <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability

WordPress Nokri - Job Board WordPress Theme plugin = 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability discovered by d.v4ns3c in WordPress Theme Nokri versions = 1.6.6...

CVE-2026-18550: Improper Privilege Management

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

PT-2026-84146

Name of the Vulnerable Software and Affected Versions Nokri - Job Board WordPress Theme versions prior to 1.6.7 Description Insufficient reset token validation in the nokri reset password function allows unauthenticated attackers to perform privilege escalation via account takeover. By providing ...

CVE-2026-81779 WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48...

CVE-2026-81779

CVE-2026-81779 is a backdoor vulnerability in the Silk Themes Newspapers X WordPress theme, discovered by ashv4ni and reported via Patchstack . It affects versions 1.0.46 through 1.0.48 and is classified as Improper Validation of Specified Quantity in Input , allowing malicious software to be imp...

CVE-2026-81779 WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48...

CVE-2026-78289 WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...

CVE-2026-78289

CVE-2026-78289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the CozyStay WordPress theme, affecting versions 1.10.0 and earlier . The vulnerability was discovered by G0053 and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, requiring user interaction. The at...

CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...