CVE-2026-66483

WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66482

WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-66480

WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62125

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62124

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62123

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62120

WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62117

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62116

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62115

WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62100

WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62099

WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62096

WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62095

WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62094

WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62093

WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62092

WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62091

WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62090

WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62087

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—