CVE-2025-69165

WordPress Choreo theme <= 1.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Choreo Wordpress

CVE-2025-69167

WordPress Eros theme <= 1.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Eros Wordpress

CVE-2025-69168

WordPress Spike theme <= 1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Spike <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Spike Wordpress

CVE-2025-69176

WordPress ITactics theme <= 1.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Itactics Wordpress

CVE-2026-39522

WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Solene Wordpress

CVE-2026-39547

WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Getaway Wordpress

CVE-2026-39554

WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Fidalgo Wordpress

CVE-2026-39567

WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Santé Wordpress

CVE-2026-39568

WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Mr Seo Wordpress

CVE-2026-39577

WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Playroom Wordpress

CVE-2026-39578

WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Valiance Wordpress

CVE-2026-39580

WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Micdrop Wordpress

CVE-2026-40751

WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Ashtanga Wordpress

CVE-2026-40755

WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Techlink Wordpress

CVE-2026-40758

WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Léonie Wordpress

CVE-2026-40759

WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Esmée Wordpress

CVE-2026-11409

OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

CVSS 4.0 · 8.5 High EPSS 2.8% KEV · Not listed

Vendors

Tp-link

Products

Tl-wr940n Tl-wr940n Firmware Tl-wr940n V6

CVE-2025-66391

Unauthorized Write Operations Triggered by Read-Only Accounts in Citrix Cloud

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Citrix Cloud

CVE-2025-26240

Python-pdfkit from_string Method Allows Server-Side JavaScript Execution and Local File Exfiltration

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Jazzcore

Products

Python-pdfkit

CVE-2026-36418

Remote Code Execution via Improper Handling of Aviator Expressions in JimuReport

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute arbitrary code.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jimureport