TI-2026-22823 CVE-2026-28570 · GHSA-2rw8-9q84-mmgp
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Priority LOW 38
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
SpabRice
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
SpabRice records in CISA KEVNo SpabRice vulnerabilities are listed in CISA KEV.
Records
4 records
TI-2026-70015 CVE-2026-94066 · GHSA-vmrf-m5x3-48m3
Reflected cross-site scripting in SpabRice Pond WordPress theme
Priority LOW 30
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.
TI-2026-28613 CVE-2026-39642 · GHSA-xmff-c6m5-xm5c
WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability
Priority LOW 30
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection.
TI-2026-28608 CVE-2026-39637 · GHSA-vvr2-x7rw-p62r
WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability
Priority LOW 30
Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.