21025 matches found
CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...
PT-2026-79553
Name of the Vulnerable Software and Affected Versions GreenShift – Animation and Page Builder Blocks versions prior to 12.9.0 Description The GreenShift – Animation and Page Builder Blocks plugin for WordPress allows unauthorized modification of data. The issue stems from a missing capability che...
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Khuong Hai & Thanh Nam HPT Vietnam in WordPress Theme Urna versions = 2.6.2...
WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jawn versions = 1.4.2...
CVE-2026-66672
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66612
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Koji = 2.2.1 versions...
CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Koji = 2.2.1 versions...
CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-66673 WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...
CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647
CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...
EUVD-2026-63297
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...