Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

CVE-2026-28043

WordPress Healer - Doctor, Clinic & Medical WordPress Theme theme <= 1.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer allows PHP Local File Inclusion.This issue affects Healer - Doctor, Clinic & Medical WordPress Theme: from n/a through <= 1.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Healer - Doctor, Clinic & Medical Wordpress Theme Wordpress
CVE-2026-28035

WordPress Printy theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Printy printy allows PHP Local File Inclusion.This issue affects Printy: from n/a through <= 1.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Printy Wordpress
CVE-2026-28057

WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Mandala mandala allows PHP Local File Inclusion.This issue affects Mandala: from n/a through <= 2.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Mandala Wordpress
CVE-2026-28128

WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through <= 1.7.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Verse Wordpress
CVE-2026-28049

WordPress Police Department theme <= 2.17 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Police Department police-department allows PHP Local File Inclusion.This issue affects Police Department: from n/a through <= 2.17.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Police Department Wordpress
CVE-2025-8899

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Videowhisper Wordpress
Products
Paid Videochat Turnkey Site – Html5 Ppv Live Webcams Wordpress
CVE-2026-28060

WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX S.King stephanie-king allows PHP Local File Inclusion.This issue affects S.King: from n/a through <= 1.5.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
S.king Wordpress
CVE-2026-28075

WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto porto allows Reflected XSS.This issue affects Porto: from n/a through <= 7.6.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
P-themes Wordpress
Products
Porto Wordpress
CVE-2026-28087

WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Filmax filmax allows PHP Local File Inclusion.This issue affects Filmax: from n/a through <= 1.1.11.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Filmax Wordpress
CVE-2026-28028

WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through <= 1.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Moneyflow Wordpress
CVE-2024-35644

WordPress Preferred Languages plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pascal Birchler Preferred Languages allows DOM-Based XSS.This issue affects Preferred Languages: from n/a through 2.2.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pascal Birchler Wordpress
Products
Preferred Languages Wordpress
CVE-2026-28113

WordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Reflected XSS.This issue affects Ultimate Learning Pro: from n/a through <= 3.9.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Azzaroco Wordpress
Products
Ultimate Learning Pro Wordpress
CVE-2026-28027

WordPress Kayon theme <= 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Kayon kayon allows PHP Local File Inclusion.This issue affects Kayon: from n/a through <= 1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Kayon Wordpress
CVE-2026-28086

WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Run Gran run-gran allows PHP Local File Inclusion.This issue affects Run Gran: from n/a through <= 2.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Run Gran Wordpress
CVE-2026-1569

Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode

The Wueen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wueen-blocket` shortcode in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nabeghe Wordpress
Products
Wueen Wordpress
CVE-2026-1574

MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The MyQtip – easy qTip2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `myqtip` shortcode in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dgamoni Wordpress
Products
Myqtip – Easy Qtip2 Wordpress
CVE-2026-28093

WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Ozisti ozisti allows PHP Local File Inclusion.This issue affects Ozisti: from n/a through <= 1.1.10.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Ozisti Wordpress
CVE-2026-28094

WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX RexCoin rexcoin allows PHP Local File Inclusion.This issue affects RexCoin: from n/a through <= 1.2.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Rexcoin Wordpress
CVE-2026-28100

WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider PerpetuumMobile uberSlider_perpetuummobile allows Reflected XSS.This issue affects UberSlider PerpetuumMobile: from n/a through <= 2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Lambertgroup Wordpress
Products
Uberslider Perpetuummobile Wordpress
CVE-2026-28105

WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Good Energy Wordpress