Vulnerabilities

TI-2026-20556 CVE-2026-25442 · GHSA-6vgx-9q2h-xcvx

WordPress Kentha theme <= 4.7.2 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes Kentha kentha allows Reflected XSS.This issue affects Kentha: from n/a through <= 4.7.2.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00155 Published 2026-03-19 No fix listed CWE-79

TI-2026-19663 CVE-2026-24390 · GHSA-5397-57rf-7pmh

WordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets kentha-elementor allows PHP Local File Inclusion.This issue a…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00361 Published 2026-01-22 No fix listed CWE-98

TI-2025-42458 CVE-2025-69003 · GHSA-m4gg-mrh3-p357

WordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes KenthaRadio qt-kentharadio allows Reflected XSS.This issue affects KenthaRadio: from n/a through <= 2.2.0…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00226 Published 2026-01-22 No fix listed CWE-79

TI-2025-16594 CVE-2025-22712 · GHSA-q48c-25gr-hmq3

WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a thro…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00574 Published 2026-01-08 No fix listed CWE-98

TI-2021-06760 CVE-2021-24472 · GHSA-j66q-h2jj-3578

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

HIGH 75

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.56614 Published 2021-08-02 Fixed in 2.0.2, 3.9.9.2 CWE-918