Vulnerabilities

TI-2026-67947 CVE-2026-39748 · GHSA-qj45-xphp-vcfg

Reflected cross-site scripting in WordPress EduMall theme

LOW 31

Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-10-06 No fix listed CWE-79

TI-2026-41619 CVE-2026-57797 · GHSA-hpjc-qvfv-8fg6

WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00329 Published 2026-07-13 No fix listed CWE-862

TI-2026-41613 CVE-2026-57791 · GHSA-7pcc-hrvx-j227

WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <=…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2026-41612 CVE-2026-57790 · GHSA-fwfq-6rq4-g239

WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00511 Published 2026-07-13 No fix listed CWE-98

TI-2025-42548 CVE-2025-69094 · GHSA-gq2f-q58f-r6j8

WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability

LOW 37

Subscriber SQL Injection in Unicamp <= 2.2.2 versions.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00357 Published 2026-07-02 No fix listed CWE-89

TI-2026-28564 CVE-2026-39590 · GHSA-36mf-659q-qxg2

WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability

LOW 37

Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00338 Published 2026-06-17 No fix listed CWE-98

TI-2026-20212 CVE-2026-25027 · GHSA-gqgj-vrh4-f89w

WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a thro…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00361 Published 2026-02-03 No fix listed CWE-98

TI-2025-16590 CVE-2025-22708 · GHSA-8pjf-95f6-p42g

WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00574 Published 2026-01-08 No fix listed CWE-98

TI-2025-16589 CVE-2025-22707 · GHSA-275c-83p3-m29v

WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00574 Published 2026-01-08 No fix listed CWE-98

TI-2025-13181 CVE-2025-14430 · GHSA-5rpj-6xpw-5hwm

WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <=…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00484 Published 2026-01-08 No fix listed CWE-98

TI-2025-13180 CVE-2025-14429 · GHSA-m2mx-2p58-mxhx

WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a t…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00484 Published 2026-01-08 No fix listed CWE-98

TI-2025-37435 CVE-2025-60069 · GHSA-v69r-77xw-v277

WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00499 Published 2025-12-18 No fix listed CWE-98

TI-2025-41671 CVE-2025-68062 · GHSA-88h2-6jrv-8v63

WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00361 Published 2025-12-16 No fix listed CWE-98

TI-2025-41670 CVE-2025-68061 · GHSA-m8v7-p7rh-pfq6

WordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a thro…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00361 Published 2025-12-16 No fix listed CWE-98

TI-2025-37094 CVE-2025-59564 · GHSA-qqp2-3fwq-fh2c

WordPress EduMall Theme < 4.4.5 - Local File Inclusion Vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a thro…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00535 Published 2025-10-22 No fix listed CWE-98

TI-2025-37088 CVE-2025-59558 · GHSA-6wqj-pjvm-wm8m

WordPress Billey Theme < 2.1.6 - Local File Inclusion Vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00535 Published 2025-10-22 No fix listed CWE-98

TI-2025-37087 CVE-2025-59557 · GHSA-wx23-gjgp-3rgc

WordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00371 Published 2025-10-22 No fix listed CWE-89

TI-2025-37085 CVE-2025-59555 · GHSA-4f82-443q-jmxf

WordPress Medizin Theme < 1.9.7 - Local File Inclusion Vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a thro…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00535 Published 2025-10-22 No fix listed CWE-98

TI-2025-36611 CVE-2025-58967 · GHSA-m8h5-c3cp-8g8c

WordPress Businext theme < 2.4.4 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP Local File Inclusion.This issue affects Businext: from n/a t…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00535 Published 2025-10-22 No fix listed CWE-98

TI-2025-36602 CVE-2025-58958 · GHSA-jcpw-4r4x-cww9

WordPress SmilePure Theme < 1.8.5 - Local File Inclusion Vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00535 Published 2025-10-22 No fix listed CWE-98

TI-2025-33270 CVE-2025-53303 · GHSA-3533-r6pg-9ghx

WordPress ThemeMove Core Plugin <= 1.4.2 - PHP Object Injection Vulnerability

MEDIUM 40

Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00383 Published 2025-09-09 No fix listed CWE-502

TI-2025-36011 CVE-2025-58206 · GHSA-5vjc-m9g9-9f4p

WordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion Vulnerability

MEDIUM 43

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00528 Published 2025-09-05 No fix listed CWE-98

TI-2025-36015 CVE-2025-58210 · GHSA-j392-f58p-c38q

WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability

MEDIUM 48

Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00254 Published 2025-09-03 No fix listed CWE-862

TI-2025-34464 CVE-2025-54701 · GHSA-7w94-qc97-fm9m

WordPress Unicamp Theme <= 2.6.3 - Local File Inclusion Vulnerability

MEDIUM 44

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a thro…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00533 Published 2025-08-14 No fix listed CWE-98

TI-2025-34463 CVE-2025-54700 · GHSA-9h37-cj8f-m493

WordPress Makeaholic Theme <= 1.8.4 - Local File Inclusion Vulnerability

MEDIUM 44

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic makeaholic allows PHP Local File Inclusion.This issue affects Makeaholic: from…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00533 Published 2025-08-14 No fix listed CWE-98

Vulnerabilities

Filters