Vulnerabilities

TI-2026-79740 CVE-2026-112854 · GHSA-m93c-ph3f-wmg5

Object injection in WordPress Holistic Center theme

MEDIUM 43

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502

TI-2026-79739 CVE-2026-112853 · GHSA-w38j-prhv-7qfm

PHP object injection in WordPress Hallelujah theme

MEDIUM 49

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00408 Published 2026-10-23 No fix listed CWE-502

TI-2026-79743 CVE-2026-112857 · GHSA-4jgx-23fw-g479

PHP object injection in WordPress Reprizo theme

MEDIUM 49

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00408 Published 2026-10-23 No fix listed CWE-502

TI-2026-79744 CVE-2026-112858 · GHSA-c7g4-27cm-3cj8

PHP object injection in WordPress Rhodos theme

MEDIUM 49

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502

TI-2026-79741 CVE-2026-112855 · GHSA-rp4f-997r-jc7c

PHP object injection in WordPress Redy theme

MEDIUM 49

Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502

TI-2026-70435 CVE-2026-66569 · GHSA-67gf-mq47-63m5

PHP object injection in WordPress Kicker theme

MEDIUM 49

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502

TI-2026-70434 CVE-2026-66568 · GHSA-7hr6-wjj3-8fvf

PHP object injection in WordPress Original theme

MEDIUM 49

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502

TI-2026-70431 CVE-2026-66565 · GHSA-gpxw-g22x-43pr

PHP object injection in WordPress FC United theme

MEDIUM 49

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502

TI-2026-70348 CVE-2026-42704 · GHSA-q9qm-hg22-3w6v

Local file inclusion in WordPress Kids Care theme

LOW 37

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-10-10 No fix listed CWE-98

TI-2026-70190 CVE-2026-93945 · GHSA-4236-v7g9-hpxg

PHP object injection in WordPress Balance theme

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502

TI-2026-70174 CVE-2026-93927 · GHSA-ph3c-8hm4-xwjm

PHP object injection in Axiomthemes Veto WordPress theme

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00328 Published 2026-10-10 No fix listed CWE-502

TI-2026-46749 CVE-2026-65581 · GHSA-xqx7-fh5p-977f

WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-06 No fix listed CWE-502

TI-2026-46747 CVE-2026-65579 · GHSA-ccgm-8j36-5mhx

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-06 No fix listed CWE-502

TI-2026-46740 CVE-2026-65572 · GHSA-mq39-r4w7-92mj

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-06 No fix listed CWE-502

TI-2026-46739 CVE-2026-65571 · GHSA-98qj-xx3j-73qx

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-06 No fix listed CWE-502

TI-2026-21793 CVE-2026-27377 · GHSA-r5c7-h5q4-cjrc

WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

LOW 30

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00383 Published 2026-07-23 No fix listed CWE-862

TI-2026-41562 CVE-2026-57738 · GHSA-vj9v-j9w9-c282

WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-07-13 No fix listed CWE-502

TI-2026-17908 CVE-2026-22326 · GHSA-qf4q-78jp-hmfh

WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerability

LOW 37

Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-06-17 No fix listed CWE-98

TI-2026-17907 CVE-2026-22325 · GHSA-vv73-4rmh-8xmr

WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerability

LOW 37

Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00363 Published 2026-06-17 No fix listed CWE-98

TI-2025-42812 CVE-2025-69369 · GHSA-638h-7fhf-cjj2

WordPress Racquet theme <= 1.12.0 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00327 Published 2026-06-02 No fix listed CWE-98

TI-2025-36550 CVE-2025-58897 · GHSA-4hm4-3rw4-fgx6

WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00337 Published 2026-06-02 No fix listed CWE-98

TI-2025-36367 CVE-2025-58707 · GHSA-78v5-q9xf-23vc

WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00337 Published 2026-06-02 No fix listed CWE-98

TI-2025-36365 CVE-2025-58705 · GHSA-v598-cv4j-7mjv

WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00415 Published 2026-06-02 No fix listed CWE-98

TI-2025-33386 CVE-2025-53440 · GHSA-g258-5m36-gv56

WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00415 Published 2026-06-02 No fix listed CWE-98

TI-2026-18081 CVE-2026-22500 · GHSA-h5vf-v8w8-8c3q

WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00529 Published 2026-03-25 No fix listed CWE-502

Vulnerabilities

Filters