Vulnerabilities

TI-2026-70015 CVE-2026-94066 · GHSA-vmrf-m5x3-48m3

Reflected cross-site scripting in SpabRice Pond WordPress theme

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2026-10-09 No fix listed CWE-79

TI-2026-22823 CVE-2026-28570 · GHSA-2rw8-9q84-mmgp

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

LOW 38

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00467 Published 2026-08-18 No fix listed CWE-98

TI-2026-28613 CVE-2026-39642 · GHSA-xmff-c6m5-xm5c

WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability

LOW 30

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00255 Published 2026-05-26 No fix listed CWE-80

TI-2026-28608 CVE-2026-39637 · GHSA-vvr2-x7rw-p62r

WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability

LOW 30

Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00236 Published 2026-04-08 No fix listed CWE-862

Vulnerabilities

Filters

Reflected cross-site scripting in SpabRice Pond WordPress theme

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability

WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability