EUVD-2025-210579

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

WordPress Theme Editor plugin <= 3.1 - Cross-Site Request Forgery to CSS Modification vulnerability

Cross-Site Request Forgery to CSS Modification vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Editor versions = 3.1...

PT-2026-66997

Name of the Vulnerable Software and Affected Versions Theme Editor plugin for WordPress versions prior to 3.2 Description The plugin is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to...

CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

EUVD-2026-50115

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

CVE-2026-13423: Improper Control of Generation of Code

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

Mega Wordpress Theme - Cross site scripting Detection

WordPress theme with a 'Mega-Theme' design is vulnerable to a reflected XSS attack through the '?s=' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress theme with a 'Mega-Theme' design is vulnerable to a reflected XSS attack through the '?s=' parameter.""" from kittysploit import...

Reality Estate Multipurpose WP-Theme < 2.5.3 - Cross-Site Scripting Detection

Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

JobMonster < 4.5.2.9 - Cross-Site Scripting Detection

In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """In the theme JobMonster 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Madara Theme < 2.2.2.1 - Local File Inclusion Detection

Madara WordPress theme = 2.2.2 contains a local file inclusion vulnerability caused by improper sanitization of the 'template' parameter, letting unauthenticated attackers execute arbitrary files on the server, exploit requires crafted request. !/usr/bin/env python3 -- coding: utf-8 -- """Madara...

CVE-2026-65522

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65511

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65500

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

EUVD-2026-48124

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65522 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65522

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

EUVD-2026-48117

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65511 WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65511

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...