CVE-2025-69110

WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Airsupply Wordpress

CVE-2025-69129

WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Extendons Wordpress

Products

Wordpress & Woocommerce Scraper Plugin Wordpress & Woocommerce Scraper Plugin, Import Data From Any Site Wordpress

CVE-2025-69135

WordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerability

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Curlythemes Wordpress

Products

Events Schedule - Wordpress Events Calendar Plugin Wordpress

CVE-2025-69138

WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jthemes Wordpress

Products

Genemy Wordpress

CVE-2025-69161

WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Snowy Wordpress

CVE-2025-69171

WordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Orpheus Wordpress

CVE-2025-69179

WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Theme Passion Wordpress

Products

Support Ticket Management System Wordpress

CVE-2026-22327

WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Zozothemes

Products

Wordpress Restaurt

CVE-2026-22328

WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vamtam Wordpress

Products

Auto Repair Wordpress

CVE-2026-22329

WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress

Products

Skillate Wordpress

CVE-2026-22334

WordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpos

Products

Wordpress Woocommerce Book Price

CVE-2026-22335

WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wc Lovers. Wordpress

Products

Woocommerce Frontend Manager – Ultimate Wordpress

CVE-2026-22339

WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jobster Marketplace Wordpress

Products

Wpjobster Wordpress

CVE-2026-22342

WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Premiumpress Limited. Wordpress

Products

Wordpress Dating Theme Wordpress

CVE-2026-22343

WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Premiumpress Limited. Wordpress

Products

Wordpress Dating Theme Wordpress

CVE-2026-27041

WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Studio Keren Aga Ltd. Wordpress

Products

Unlimited Elements For Elementor (premium) Wordpress

CVE-2026-27400

WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ovatheme Wordpress

Products

Bookpro Wordpress

CVE-2026-39545

WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Zermatt Wordpress

CVE-2026-39573

WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Mildhill Wordpress

CVE-2026-39582

WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Hitek