CVE-2026-27085 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

EUVD-2026-89815

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

Content Injection vulnerability discovered by savphill in WordPress Theme Astra WordPress Theme versions = 4.13.12...

CVE-2026-88797

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-88797

The Vayu X WordPress theme (versions prior to 1.0.6 ) is vulnerable to unauthorized plugin manipulation. The flaw exists because the theme fails to perform a capability check on a specific AJAX action and exposes the required nonce to all logged-in users. Consequently, any authenticated user, suc...

CVE-2026-88797 Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-88797 Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

EUVD-2026-89614

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-27085: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-87792

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

CVE-2026-87793

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-89307 HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-89307

CVE-2026-89307 affects the Design Scuole Italia WordPress theme (versions 1.0–2.17.3 ). The "Firma Circolare" feature allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling a stored HTML injection that forces visiting users to redirect to an attacker-controlled...

EUVD-2026-78668

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-87793

The "Design Scuole Italia" WordPress theme (versions 1.0–2.18.2 ) contains a Reflected Cross-Site Scripting (XSS) vulnerability in the filters-scheda-didattica.php file. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by supplying a malicious value in the archiv...

EUVD-2026-78666

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-87793 Reflected XSS in WordPress theme design-scuole-wordpress-theme

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-87792

The "Design Scuole Italia" WordPress theme (versions 1.0–2.17.3 ) is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions. An unauthenticated attacker can access restricted "Circolare" content and registered users' data; an unauthentic...

CVE-2026-87792 Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...