WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agricola versions = 1.21.0...

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agora versions = 1.9...

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Advice versions = 1.18.0...

WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Adrena versions = 1.2.14...

WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Accalia versions = 1.5.3...

WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Abogado versions = 1.18...

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Abelle versions = 1.22...

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme A.Williams versions = 1.3.1...

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme 69 Clothing versions = 1.2.11.1...

CVE-2025-9266

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...

CVE-2025-9266 Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

CVE-2025-9266 Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

EUVD-2025-210641

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Theme My Login versions = 7.1.14...

WordPress Lenxel WP theme <= 1.0.31 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Theme Lenxel WP versions = 1.0.31...

CVE-2026-66681: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

PT-2026-68583

Name of the Vulnerable Software and Affected Versions Theme My Login versions prior to 7.1.15 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...

PT-2026-68569

Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...

PT-2026-68567

Name of the Vulnerable Software and Affected Versions Agora versions prior to 2.0 Description The Agora Event & Conference WordPress Theme is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no P...