Vulnerabilities

TI-2026-70362 CVE-2026-42777 · GHSA-9wg3-82w7-8hf5

Local file inclusion in WordPress Aalto theme

LOW 37

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-10-10 No fix listed CWE-98

TI-2026-68296 CVE-2026-104747 · GHSA-wm8r-hhm6-f67f

WordPress Haaken theme PHP Object Injection

LOW 37

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0025 Published 2026-10-06 No fix listed CWE-502

TI-2025-14265 CVE-2025-15637 · GHSA-6fw2-rvrj-mw88

WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-20 No fix listed CWE-98

TI-2026-47324 CVE-2026-66653 · GHSA-23x3-w8rc-9vq7

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-13 No fix listed CWE-98

TI-2026-41622 CVE-2026-57800 · GHSA-379x-gfrj-jr3p

WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2026-41610 CVE-2026-57788 · GHSA-rxr8-5f3v-wr68

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2026-29407 CVE-2026-40738 · GHSA-c4cp-57xx-r93r

WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-17 No fix listed CWE-502

TI-2026-29404 CVE-2026-40735 · GHSA-gvc4-j6mw-jf5w

WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00395 Published 2026-06-17 No fix listed CWE-502

TI-2026-29430 CVE-2026-40761 · GHSA-8f77-6gmm-9phw

WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0025 Published 2026-06-16 No fix listed CWE-502

TI-2026-29429 CVE-2026-40760 · GHSA-29m3-j3cr-hcg3

WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0025 Published 2026-06-16 No fix listed CWE-502

TI-2026-29405 CVE-2026-40736 · GHSA-cxvr-5hwp-cjhj

WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0025 Published 2026-06-16 No fix listed CWE-502

TI-2026-28513 CVE-2026-39539 · GHSA-8hh5-4rmj-8367

WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-16 No fix listed CWE-502

TI-2026-25040 CVE-2026-32512 · GHSA-w68h-wpmm-q4p8

WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00389 Published 2026-03-25 No fix listed CWE-502

TI-2026-25038 CVE-2026-32510 · GHSA-g86r-3x4w-vj28

WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability

LOW 24

Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00173 Published 2026-03-25 No fix listed CWE-502

TI-2026-25037 CVE-2026-32509 · GHSA-rgvc-fqr7-3hvm

WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability

LOW 24

Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00179 Published 2026-03-25 No fix listed CWE-502

TI-2026-25034 CVE-2026-32506 · GHSA-7jrr-93m5-98fw

WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability

LOW 24

Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00173 Published 2026-03-25 No fix listed CWE-502

TI-2025-42853 CVE-2025-69410 · GHSA-wm24-v2x8-m9pj

WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Belletrist belletrist allows PHP Local File Inclusion.This issue affects Belletrist: fr…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00583 Published 2026-02-20 No fix listed CWE-98

TI-2025-42512 CVE-2025-69057 · GHSA-cq8c-cj5f-753q

WordPress Eldon theme <= 1.0 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Eldon eldon allows PHP Local File Inclusion.This issue affects Eldon: from n/a through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00574 Published 2026-01-22 No fix listed CWE-98

TI-2025-42505 CVE-2025-69050 · GHSA-m4gc-3hh2-cgfv

WordPress Overworld theme <= 1.3 - Local File Inclusion vulnerability

LOW 38

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00484 Published 2026-01-22 No fix listed CWE-98

TI-2025-42443 CVE-2025-68987 · GHSA-v45r-hm43-6rhp

WordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00462 Published 2025-12-30 No fix listed CWE-98

TI-2025-39728 CVE-2025-64287 · GHSA-699q-v8cp-38m8

WordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Al…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00434 Published 2025-11-06 No fix listed CWE-98

TI-2025-39018 CVE-2025-62868 · GHSA-hvxj-gppg-mpmp

WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00469 Published 2025-10-24 No fix listed CWE-98

TI-2025-31804 CVE-2025-49889 · GHSA-gwx9-8fhj-ff84

WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT edge-cpt allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00669 Published 2025-08-20 No fix listed CWE-98

TI-2025-02870 CVE-2025-3278 · GHSA-4w4c-3fhx-c3w8

UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation

MEDIUM 50

The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0057 Published 2025-04-19 No fix listed CWE-269

TI-2025-01406 CVE-2025-1638 · GHSA-7v83-rjxv-m28x

Alloggio Membership <= 1.1 - Authentication Bypass via Social Login Account Takeover

MEDIUM 50

The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00635 Published 2025-03-01 No fix listed CWE-288

Vulnerabilities

Filters