Vulnerabilities

TI-2026-70370 CVE-2026-62022 · GHSA-wpxh-fjch-x32q

Privilege escalation in Tonda Membership WordPress plugin

MEDIUM 49

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00321 Published 2026-10-10 No fix listed CWE-266

TI-2026-22493 CVE-2026-28152 · GHSA-qmcv-rrc4-f8vh

WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-24 Fixed in 2.6 CWE-98

TI-2026-22492 CVE-2026-28151 · GHSA-chx6-3c4r-3q7c

WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-24 Fixed in 2.6 CWE-98

TI-2026-46647 CVE-2026-65477 · GHSA-5cr5-8xh5-2f28

WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

LOW 35

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00429 Published 2026-07-23 No fix listed CWE-98

TI-2026-41627 CVE-2026-57805 · GHSA-r6h5-jf3g-fvhp

WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a throug…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2026-41625 CVE-2026-57803 · GHSA-23pf-3ffj-v774

WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 Fixed in 2.7 CWE-98

TI-2026-41624 CVE-2026-57802 · GHSA-g223-pcjf-x592

WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 Fixed in 2.7 CWE-98

TI-2026-41623 CVE-2026-57801 · GHSA-xq8c-9769-c8mx

WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2026-29421 CVE-2026-40752 · GHSA-qjxv-pv96-chgw

WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-17 No fix listed CWE-502

TI-2026-28534 CVE-2026-39560 · GHSA-f253-rmgf-g82m

WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-17 No fix listed CWE-502

TI-2026-28547 CVE-2026-39573 · GHSA-487j-qrwp-98vf

WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00395 Published 2026-06-17 No fix listed CWE-502

TI-2026-28519 CVE-2026-39545 · GHSA-9f37-m7p7-w7h6

WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00395 Published 2026-06-17 No fix listed CWE-502

TI-2026-28554 CVE-2026-39580 · GHSA-83xw-h4pr-5qrg

WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0025 Published 2026-06-16 No fix listed CWE-502

TI-2026-28541 CVE-2026-39567 · GHSA-r8xp-hxfv-rqvr

WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

LOW 37

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00308 Published 2026-06-16 No fix listed CWE-502

TI-2026-28521 CVE-2026-39547 · GHSA-rh36-6f87-jv4v

WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability

LOW 37

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-06-16 Fixed in 1.8 CWE-98

TI-2026-28527 CVE-2026-39553 · GHSA-hfjv-pq6h-6ffm

WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00334 Published 2026-06-02 No fix listed CWE-98

TI-2026-25030 CVE-2026-32502 · GHSA-4hr4-h2px-hp7g

WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00389 Published 2026-03-25 No fix listed CWE-502

TI-2026-20570 CVE-2026-25458 · GHSA-66m2-467q-7g98

WordPress Moments theme <= 2.2 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00419 Published 2026-03-25 No fix listed CWE-98

TI-2026-20569 CVE-2026-25457 · GHSA-28r9-jxmr-8hgr

WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows PHP Local File Inclusion.This issue affects Mixtape: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00419 Published 2026-03-25 No fix listed CWE-98

TI-2026-18030 CVE-2026-22449 · GHSA-4574-w5wx-78f9

WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allows PHP Local File Inclusion.This issue affects Don Peppe: from…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00592 Published 2026-03-05 No fix listed CWE-98

TI-2026-18027 CVE-2026-22446 · GHSA-5p46-9qqx-mmp9

WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00592 Published 2026-03-05 No fix listed CWE-98

TI-2026-18004 CVE-2026-22423 · GHSA-hrp7-mvmf-8mpv

WordPress SetSail theme <= 1.8 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00592 Published 2026-03-05 No fix listed CWE-98

TI-2025-42850 CVE-2025-69407 · GHSA-3rcg-gg9q-9688

WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows PHP Local File Inclusion.This issue affects Struktur: from n…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00583 Published 2026-02-20 No fix listed CWE-98

TI-2026-19772 CVE-2026-24531 · GHSA-7rrw-hv84-79w3

WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00547 Published 2026-01-23 No fix listed CWE-98

TI-2026-18031 CVE-2026-22450 · GHSA-3qcq-p3m2-3c4p

WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2026-01-22 No fix listed CWE-862

Vulnerabilities

Filters