Wordpress Theme

CVE-2025-69330 Feb 20, 16:22 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Prestige prestige allows Reflected XSS.This issue affects Prestige: from n/a through < 1.4.1. [CVSS 7.1 HIGH]

CVE-2025-69329 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Prestige (prestige) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69322 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes PeakShops peakshops allows PHP Local File Inclusion.This issue affects PeakShops: from n/a through < 1.5.9. [CVSS 8.1 HIGH]

CVE-2025-69301 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in PhotoMe (photome) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69299 Feb 20, 16:22 HIGH This Week

Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6.0.8. [CVSS 7.2 HIGH]

CVE-2025-69298 Feb 20, 16:22 HIGH This Week

Missing Authorization vulnerability in GhostPool Gauge gauge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gauge: from n/a through <= 6.56.4. [CVSS 7.5 HIGH]

CVE-2025-69296 Feb 20, 16:22 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhostPool Aardvark aardvark allows Reflected XSS.This issue affects Aardvark: from n/a through <= 4.6.3. [CVSS 7.1 HIGH]

CVE-2025-69294 Feb 20, 16:22 HIGH This Week

Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from n/a through <= 1.5.9. [CVSS 8.8 HIGH]

CVE-2025-68545 Feb 20, 16:22 HIGH This Week

PHP Remote File Inclusion in Nika WordPress theme by thembay.

CVE-2025-68543 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15. [CVSS 8.1 HIGH]

CVE-2025-68541 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Ippsum (ippsum) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-68539 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35. [CVSS 8.1 HIGH]

CVE-2025-68536 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14. [CVSS 8.1 HIGH]

CVE-2025-67997 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Travelicious (travelicious) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-67996 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Nestin (nestin) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-67995 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in PatioTime (patiotime) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-67992 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean PatioTime patiotime allows PHP Local File Inclusion.This issue affects PatioTime: from n/a through < 2.1. [CVSS 8.1 HIGH]

CVE-2025-67988 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.9.1. [CVSS 8.1 HIGH]

CVE-2025-67982 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local File Inclusion.This issue affects Urna: from n/a through <= 2.5.12. [CVSS 8.1 HIGH]

CVE-2025-67981 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15. [CVSS 8.1 HIGH]

CVE-2025-67980 Feb 20, 16:22 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.17. [CVSS 8.1 HIGH]

CVE-2025-67547 Feb 20, 16:22 MEDIUM This Month

Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6. [CVSS 6.5 MEDIUM]

CVE-2024-56208 Feb 20, 16:22 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This issue affects NewsMash: from n/a through <= 1.0.71. [CVSS 6.5 MEDIUM]

CVE-2026-27328 Feb 19, 21:18 MEDIUM This Month

DevsBlink EduBlink versions 2.0.7 and earlier contain an authorization bypass that allows unauthenticated remote attackers to modify data through improperly configured access controls. The vulnerability enables integrity compromise without requiring authentication or user interaction, affecting all installations of the vulnerable software versions. No patch is currently available to address this issue.

CVE-2026-27069 Feb 19, 09:16 MEDIUM This Month

DOM-based cross-site scripting in PenciDesign Soledad through version 8.7.2 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers, potentially leading to session hijacking or data theft. The vulnerability requires user interaction and impacts the confidentiality, integrity, and availability of affected installations. No patch is currently available.

CVE-2026-25459 Feb 19, 09:16 MEDIUM This Month

Improper access control in uixthemes Sober through version 3.5.12 enables authenticated attackers to modify data or resources they should not have permission to access. An attacker with valid login credentials can bypass authorization checks to perform unauthorized actions. No patch is currently available for this vulnerability.

CVE-2026-25395 Feb 19, 09:16 MEDIUM This Month

Insufficient access control in ikreatethemes Business Roy versions up to 1.1.4 enables authenticated users to modify data they should not have permission to access. An attacker with valid credentials could exploit misconfigured security levels to perform unauthorized changes within the application. No patch is currently available for this vulnerability.

CVE-2026-25394 Feb 19, 09:16 MEDIUM This Month

Sparklewpthemes Fitness FSE plugin versions up to 1.0.6 contains a missing authorization check that allows authenticated users to modify content they should not have access to. An attacker with low-level user privileges can exploit this access control misconfiguration to alter website data without proper permission.

CVE-2026-25393 Feb 19, 09:16 MEDIUM This Month

Unauthorized data modification in Hello FSE WordPress theme version 1.0.6 and earlier results from improper access control enforcement. Authenticated users can exploit this vulnerability to make unauthorized changes to website content or settings without proper permission checks.

CVE-2026-25374 Feb 19, 09:16 MEDIUM This Month

Inadequate access control in raratheme Spa and Salon plugin versions 1.3.2 and earlier permits unauthorized users to modify sensitive data through improperly configured security levels. An unauthenticated remote attacker can exploit this vulnerability to perform unauthorized actions without authentication. No patch is currently available for this vulnerability.

CVE-2026-25367 Feb 19, 09:16 MEDIUM This Month

NooTheme CitiLights versions below 3.7.2 contain an authorization bypass that allows unauthenticated remote attackers to modify data through improperly configured access controls. The vulnerability enables unauthorized state changes without requiring user interaction or elevated privileges. A patch is not currently available for this vulnerability.

CVE-2026-25337 Feb 19, 09:16 MEDIUM This Month

Coachify versions 1.1.5 and earlier contain a cross-site request forgery vulnerability that allows unauthenticated attackers to perform unintended actions on behalf of authenticated users through crafted requests. An attacker can leverage this to modify user data or trigger unwanted functionality with user interaction. No patch is currently available for this vulnerability.

CVE-2026-25336 Feb 19, 09:16 MEDIUM This Month

Coachify plugin versions 1.1.5 and earlier contain an authorization bypass that allows unauthenticated remote attackers to exploit misconfigured access controls. This vulnerability enables denial of service attacks without requiring user interaction or authentication.

CVE-2026-25333 Feb 19, 09:16 MEDIUM This Month

The Shopwell theme for Shopify versions 1.0.11 and earlier contains improper access control that allows unauthenticated remote attackers to view sensitive information through incorrectly configured authorization checks. This vulnerability exposes confidential data without requiring authentication or user interaction. No patch is currently available.

CVE-2026-25305 Feb 19, 09:16 MEDIUM This Month

DOM-based cross-site scripting in 8theme XStore through version 9.6.4 allows authenticated attackers to inject malicious scripts that execute in users' browsers, potentially stealing sensitive information or performing actions on behalf of victims. The vulnerability requires user interaction and affects the scope beyond the vulnerable component, with no patch currently available.

CVE-2026-25006 Feb 19, 09:16 MEDIUM This Month

XStore versions 9.6.4 and earlier fail to properly sanitize HTML script tags, enabling attackers to inject malicious code that executes in users' browsers. This stored or reflected cross-site scripting vulnerability requires no authentication or user interaction, allowing attackers to steal session tokens, deface content, or redirect users to malicious sites. No patch is currently available, leaving affected installations vulnerable.

CVE-2025-12821 Feb 19, 07:17 HIGH This Week

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.6.1. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. [CVSS 8.8 HIGH]

CVE-2026-24961 Feb 03, 15:16 MEDIUM This Month

ThemeGoods Grand Blog versions prior to 3.1.5 contain a server-side request forgery vulnerability that allows unauthenticated remote attackers to make arbitrary HTTP requests from the affected server. The vulnerability enables attackers to access internal resources or interact with backend services on behalf of the server, potentially leading to information disclosure or lateral movement within the network. No patch is currently available for this issue.

CVE-2026-24631 Jan 23, 15:16 MEDIUM This Month

Mikado-Themes Rosebud rosebud is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-24615 Jan 23, 15:16 MEDIUM This Month

Cream Magazine versions up to 2.1.10 contain an authorization bypass vulnerability that allows unauthenticated remote attackers to access restricted functionality through misconfigured access control settings. The vulnerability exposes sensitive information with no authentication or user interaction required, affecting all installations running the vulnerable versions. No patch is currently available for this issue.

CVE-2026-24612 Jan 23, 15:16 MEDIUM This Month

Orchid Store versions up to 1.5.15 contain an authorization bypass that allows unauthenticated remote attackers to access sensitive information due to improperly configured access controls. This vulnerability enables unauthorized users to read restricted data without requiring authentication or user interaction. No patch is currently available.

CVE-2026-24607 Jan 23, 15:16 MEDIUM This Month

Unauthorized access in Travel Monster WordPress plugin versions up to 1.3.3 results from improper access control configuration, allowing unauthenticated attackers to gain limited information disclosure. The vulnerability affects all installations of the affected plugin versions and currently has no available patch.

CVE-2026-24381 Jan 22, 17:16 MEDIUM This Month

ThemeGoods PhotoMe versions below 5.7.2 contain a server-side request forgery vulnerability that allows unauthenticated attackers to perform arbitrary HTTP requests on behalf of the affected server. The vulnerability requires user interaction to exploit and can lead to information disclosure or unintended modifications on the target system. No patch is currently available.

CVE-2026-23974 Jan 22, 17:16 MEDIUM This Month

Uxper Golo versions prior to 1.7.5 contain an access control bypass that allows authenticated attackers to exploit improperly configured security levels to gain unauthorized access to sensitive functions and data. An attacker with valid credentials can leverage this missing authorization check to escalate privileges and perform administrative actions without proper permission validation. No patch is currently available for this high-severity vulnerability (CVSS 8.8).

CVE-2026-22469 Jan 22, 17:16 MEDIUM This Month

DeepDigital versions 1.0.2 and earlier fail to properly sanitize HTML script tags, enabling stored or reflected cross-site scripting (XSS) attacks that allow code injection. An unauthenticated attacker can exploit this vulnerability over the network to inject malicious scripts that execute in users' browsers, potentially compromising session data or performing unauthorized actions. No patch is currently available for affected installations.

CVE-2026-22458 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Wanderland version 1.5 and earlier contains an authorization bypass that allows unauthenticated remote attackers to access restricted functionality due to improperly configured access controls. The vulnerability enables information disclosure with no patch currently available.

CVE-2026-22450 Jan 22, 17:16 MEDIUM This Month

The Don Peppe WordPress theme version 1.3 and earlier contains inadequate access control validation that permits authenticated users to access sensitive information they should not have permission to view. An attacker with valid login credentials could exploit this misconfiguration to retrieve confidential data, though the impact is limited to information disclosure without the ability to modify or delete content.

CVE-2026-22447 Jan 22, 17:16 MEDIUM This Month

Select-Themes Prowess through version 1.8.1 contains an authorization bypass vulnerability that allows unauthenticated remote attackers to access sensitive information due to improperly configured access controls. An attacker can exploit this flaw to read confidential data without requiring authentication or user interaction. No patch is currently available for this vulnerability.

CVE-2026-22430 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Verdure verdure is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22426 Jan 22, 17:16 MEDIUM This Month

Elated-Themes Sweet Jane sweetjane is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22411 Jan 22, 17:16 LOW Monitor

Mikado-Themes Dolcino dolcino is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22409 Jan 22, 17:16 LOW Monitor

Mikado-Themes Justicia justicia is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22407 Jan 22, 17:16 LOW Monitor

Mikado-Themes Roam through version 2.1.1 contains an authorization bypass vulnerability where attackers with valid user credentials can manipulate access control mechanisms to gain unauthorized access to sensitive functionality. This authentication-required vulnerability allows authenticated users to circumvent properly configured security levels through user-controlled parameters. No patch is currently available for this issue.

CVE-2026-22406 Jan 22, 17:16 LOW Monitor

Mikado-Themes Overton overton is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22404 Jan 22, 17:16 LOW Monitor

Mikado-Themes Innovio innovio is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22400 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Holmes holmes is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22398 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Fleur fleur is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22396 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Fiorello fiorello is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22393 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Curly curly is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2026-22391 Jan 22, 17:16 MEDIUM This Month

Mikado-Themes Cocco cocco is affected by authorization bypass through user-controlled key (CVSS 5.4).

CVE-2025-69321 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5. [CVSS 7.1 HIGH]

CVE-2025-69320 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7. [CVSS 7.1 HIGH]

CVE-2025-69317 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through < 2.4.6. [CVSS 6.1 MEDIUM]

CVE-2025-69314 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through < 4.8.3. [CVSS 8.1 HIGH]

CVE-2025-69190 Jan 22, 17:16 HIGH This Week

Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6. [CVSS 7.3 HIGH]

CVE-2025-69100 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.This issue affects North: from n/a through <= 5.7.5. [CVSS 8.1 HIGH]

CVE-2025-69099 Jan 22, 17:16 HIGH This Week

Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5. [CVSS 8.8 HIGH]

CVE-2025-69079 Jan 22, 17:16 CRITICAL Act Now

ThemeREX Sound/musicplace WordPress theme has an insecure deserialization vulnerability enabling PHP object injection and potential remote code execution.

CVE-2025-69078 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Malta malta allows PHP Local File Inclusion.This issue affects Malta: from n/a through <= 1.3.3. [CVSS 8.1 HIGH]

CVE-2025-69077 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hobo hobo allows PHP Local File Inclusion.This issue affects Hobo: from n/a through <= 1.0.10. [CVSS 8.1 HIGH]

CVE-2025-69076 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Modern Housewife modernhousewife allows PHP Local File Inclusion.This issue affects Modern Housewife: from n/a through <= 1.0.12. [CVSS 8.1 HIGH]

CVE-2025-69075 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Local File Inclusion.This issue affects Yolox: from n/a through <= 1.0.15. [CVSS 8.1 HIGH]

CVE-2025-69074 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pearson Specter pearsonspecter allows PHP Local File Inclusion.This issue affects Pearson Specter: from n/a through <= 1.11.3. [CVSS 8.1 HIGH]

CVE-2025-69073 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Piqes piqes allows PHP Local File Inclusion.This issue affects Piqes: from n/a through <= 1.0.11. [CVSS 8.1 HIGH]

CVE-2025-69072 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP Local File Inclusion.This issue affects Prider: from n/a through <= 1.1.3.1. [CVSS 8.1 HIGH]

CVE-2025-69071 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes TanTum tantum allows PHP Local File Inclusion.This issue affects TanTum: from n/a through <= 1.1.13. [CVSS 8.1 HIGH]

CVE-2025-69070 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tornados tornados allows PHP Local File Inclusion.This issue affects Tornados: from n/a through <= 2.1. [CVSS 8.1 HIGH]

CVE-2025-69068 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Muji muji allows PHP Local File Inclusion.This issue affects Muji: from n/a through <= 1.2.0. [CVSS 8.1 HIGH]

CVE-2025-69067 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tails tails allows PHP Local File Inclusion.This issue affects Tails: from n/a through <= 1.4.12. [CVSS 8.1 HIGH]

CVE-2025-69066 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Indoor Plants indoor-plants allows PHP Local File Inclusion.This issue affects Indoor Plants: from n/a through <= 1.2.7. [CVSS 8.1 HIGH]

CVE-2025-69065 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local File Inclusion.This issue affects Snow Mountain: from n/a through <= 1.4.3. [CVSS 8.1 HIGH]

CVE-2025-69064 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pets Land petsland allows PHP Local File Inclusion.This issue affects Pets Land: from n/a through <= 1.2.8. [CVSS 8.1 HIGH]

CVE-2025-69062 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Weedles weedles allows PHP Local File Inclusion.This issue affects Weedles: from n/a through <= 1.1.12. [CVSS 8.1 HIGH]

CVE-2025-69061 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP Local File Inclusion.This issue affects MoveMe: from n/a through <= 1.2.15. [CVSS 8.1 HIGH]

CVE-2025-69060 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes uReach ureach allows PHP Local File Inclusion.This issue affects uReach: from n/a through <= 1.3.3. [CVSS 8.1 HIGH]

CVE-2025-69059 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DiveIt diveit allows PHP Local File Inclusion.This issue affects DiveIt: from n/a through <= 1.4.3. [CVSS 8.1 HIGH]

CVE-2025-69058 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes PartyMaker partymaker allows PHP Local File Inclusion.This issue affects PartyMaker: from n/a through <= 1.1.15. [CVSS 8.1 HIGH]

CVE-2025-69057 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Eldon eldon allows PHP Local File Inclusion.This issue affects Eldon: from n/a through <= 1.0. [CVSS 8.1 HIGH]

CVE-2025-69050 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.3. [CVSS 8.1 HIGH]

CVE-2025-69049 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Töbel tobel allows PHP Local File Inclusion.This issue affects Töbel: from n/a through <= 1.6. [CVSS 8.1 HIGH]