Vulnerabilities

TI-2026-79250 CVE-2026-112820 · GHSA-hvw3-hvx7-xjjq

Local file inclusion in WordPress Academist Core plugin

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Acad…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00438 Published 2026-10-22 No fix listed CWE-98

TI-2026-70432 CVE-2026-66566 · GHSA-x2pv-34vv-36qv

Local file inclusion in WordPress Ambient theme

LOW 37

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00274 Published 2026-10-10 No fix listed CWE-98

TI-2026-54565 CVE-2026-78478 · GHSA-h4m2-w2c9-4x9f

Måne <= 1.7 - Unauthenticated Local File Inclusion

LOW 39

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00792 Published 2026-08-25 No fix listed CWE-98

TI-2026-47339 CVE-2026-66670 · GHSA-97pr-h63m-phh4

WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-24 No fix listed CWE-98

TI-2026-47340 CVE-2026-66671 · GHSA-w62x-725c-34v9

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-24 No fix listed CWE-98

TI-2026-46651 CVE-2026-65481 · GHSA-m9g5-jr43-6grw

WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

LOW 35

Contributor Local File Inclusion in Vino <= 1.9 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00429 Published 2026-07-23 No fix listed CWE-98

TI-2026-41615 CVE-2026-57793 · GHSA-h7gc-j36r-4vhq

WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2026-30682 CVE-2026-42382 · GHSA-c2j6-447q-jv3m

WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-07-02 No fix listed CWE-98

TI-2026-28550 CVE-2026-39576 · GHSA-7hqf-cj89-q6qr

WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00395 Published 2026-06-17 No fix listed CWE-502

TI-2026-28530 CVE-2026-39556 · GHSA-767j-h2g4-5g57

WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-17 No fix listed CWE-502

TI-2026-28497 CVE-2026-39523 · GHSA-rw9c-r55h-frmg

WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability

LOW 37

Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-06-17 No fix listed CWE-98

TI-2026-28532 CVE-2026-39558 · GHSA-4qxr-q27x-w926

WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability

LOW 37

Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-06-17 No fix listed CWE-98

TI-2026-29427 CVE-2026-40758 · GHSA-m57w-65j8-qxv7

WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0032 Published 2026-06-16 No fix listed CWE-502

TI-2026-29423 CVE-2026-40754 · GHSA-h6vc-2cc5-fjc6

WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0025 Published 2026-06-16 No fix listed CWE-502

TI-2026-28552 CVE-2026-39578 · GHSA-c5gq-2xwj-534f

WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability

LOW 35

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.0027 Published 2026-06-16 No fix listed CWE-502

TI-2026-28551 CVE-2026-39577 · GHSA-r5m9-6jrc-4936

WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability

LOW 35

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.00205 Published 2026-06-16 No fix listed CWE-502

TI-2026-28542 CVE-2026-39568 · GHSA-g535-3xfj-qv8q

WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Mr.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00423 Published 2026-06-16 No fix listed CWE-98

TI-2026-28531 CVE-2026-39557 · GHSA-356q-qcqm-44cg

WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00395 Published 2026-06-16 No fix listed CWE-502

TI-2026-28528 CVE-2026-39554 · GHSA-h2jc-95w4-3ppp

WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-16 No fix listed CWE-502

TI-2026-28523 CVE-2026-39549 · GHSA-jfg5-fx68-8hpc

WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00423 Published 2026-06-16 No fix listed CWE-98

TI-2026-28496 CVE-2026-39522 · GHSA-m337-6236-8fcq

WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00423 Published 2026-06-16 No fix listed CWE-98

TI-2026-28529 CVE-2026-39555 · GHSA-w594-jcp9-58h9

WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability

LOW 37

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00255 Published 2026-06-02 No fix listed CWE-502

TI-2026-28525 CVE-2026-39551 · GHSA-2w4f-7crj-wgcm

WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability

LOW 37

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-02 No fix listed CWE-502

TI-2026-28524 CVE-2026-39550 · GHSA-4mp4-954f-p5jr

WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability

LOW 37

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-02 No fix listed CWE-502

TI-2026-25035 CVE-2026-32507 · GHSA-x46f-v56p-c92m

WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability

LOW 24

Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00173 Published 2026-03-25 No fix listed CWE-502

Vulnerabilities

Filters