CVE-2025-69171

WordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Orpheus Wordpress

CVE-2025-69179

WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Theme Passion Wordpress

Products

Support Ticket Management System Wordpress

CVE-2026-22327

WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Zozothemes

Products

Wordpress Restaurt

CVE-2026-22328

WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vamtam Wordpress

Products

Auto Repair Wordpress

CVE-2026-22329

WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress

Products

Skillate Wordpress

CVE-2026-22334

WordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpos

Products

Wordpress Woocommerce Book Price

CVE-2026-22335

WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wc Lovers. Wordpress

Products

Woocommerce Frontend Manager – Ultimate Wordpress

CVE-2026-22339

WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jobster Marketplace Wordpress

Products

Wpjobster Wordpress

CVE-2026-22342

WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Premiumpress Limited. Wordpress

Products

Wordpress Dating Theme Wordpress

CVE-2026-22343

WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Premiumpress Limited. Wordpress

Products

Wordpress Dating Theme Wordpress

CVE-2026-27041

WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Studio Keren Aga Ltd. Wordpress

Products

Unlimited Elements For Elementor (premium) Wordpress

CVE-2026-27400

WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ovatheme Wordpress

Products

Bookpro Wordpress

CVE-2026-39545

WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Zermatt Wordpress

CVE-2026-39573

WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Mildhill Wordpress

CVE-2026-39582

WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Hitek

CVE-2026-39589

WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

A Wp Life Wordpress

Products

Webenvo Wordpress

CVE-2026-40724

WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerability

CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Client Portal Ltd. Wordpress

Products

Client Portal (pro) Wordpress

CVE-2026-40725

WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Barn2 Media Ltd Wordpress

Products

Woocommerce Product Filters Wordpress

CVE-2026-40726

WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Themegrill Wordpress

Products

User Registration Stripe Wordpress

CVE-2026-40746

WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themagnifico52 Wordpress

Products

Restaurant Zone Wordpress