CVE-2025-69160

WordPress Gita theme <= 1.11 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Gita <= 1.11 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Gita Wordpress

CVE-2025-69162

WordPress Grecko theme <= 5.17 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Grecko Wordpress

CVE-2025-69163

WordPress WineShop theme <= 3.17 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Wineshop Wordpress

CVE-2025-69165

WordPress Choreo theme <= 1.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Choreo Wordpress

CVE-2025-69167

WordPress Eros theme <= 1.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Eros Wordpress

CVE-2025-69168

WordPress Spike theme <= 1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Spike <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Spike Wordpress

CVE-2025-69176

WordPress ITactics theme <= 1.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Itactics Wordpress

CVE-2026-39522

WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Solene Wordpress

CVE-2026-39547

WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Getaway Wordpress

CVE-2026-39554

WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Fidalgo Wordpress

CVE-2026-39567

WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Santé Wordpress

CVE-2026-39568

WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Mr Seo Wordpress

CVE-2026-39577

WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Playroom Wordpress

CVE-2026-39578

WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Valiance Wordpress

CVE-2026-39580

WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Micdrop Wordpress

CVE-2026-40751

WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Ashtanga Wordpress

CVE-2026-40755

WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Techlink Wordpress

CVE-2026-40758

WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Léonie Wordpress

CVE-2026-40759

WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mikado-themes Wordpress

Products

Esmée Wordpress

CVE-2026-11409

OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

CVSS 4.0 · 8.5 High EPSS 2.8% KEV · Not listed

Vendors

Tp-link

Products

Tl-wr940n Tl-wr940n Firmware Tl-wr940n V6