Explore CVE records

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22523

WordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra WordPress Admin ultra-admin allows Reflected XSS.This issue affects Ultra WordPress Admin: from n/a through <= 11.7.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:23 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22520

WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.

Excerpt language: en.

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22516

WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wizor's wizors-investments allows PHP Local File Inclusion.This issue affects Wizor's: from n/a through <= 2.12.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:23 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22515

WordPress VegaDays theme <= 1.2.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:23 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22514

WordPress Unica theme <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Unica unica allows PHP Local File Inclusion.This issue affects Unica: from n/a through <= 1.4.1.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:23 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22513

WordPress Triompher theme <= 1.1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Triompher triompher allows PHP Local File Inclusion.This issue affects Triompher: from n/a through <= 1.1.0.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22512

WordPress Roisin theme <= 1.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Roisin roisin allows PHP Local File Inclusion.This issue affects Roisin: from n/a through <= 1.2.1.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22511

WordPress NeoBeat theme <= 1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes NeoBeat neobeat allows PHP Local File Inclusion.This issue affects NeoBeat: from n/a through <= 1.2.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22510

WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6.3.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22509

WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gioia gioia allows PHP Local File Inclusion.This issue affects Gioia: from n/a through <= 1.4.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22508

WordPress Dentalux theme <= 3.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Dentalux dentalux allows PHP Local File Inclusion.This issue affects Dentalux: from n/a through <= 3.3.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22507

WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:22 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22506

WordPress Amoli theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Amoli amoli allows PHP Local File Inclusion.This issue affects Amoli: from n/a through <= 1.0.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:21 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22505

WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: from n/a through <= 1.2.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:21 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22504

WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ProLingua prolingua allows PHP Local File Inclusion.This issue affects ProLingua: from n/a through <= 1.1.12.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:21 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22503

WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nelson nelson allows PHP Local File Inclusion.This issue affects Nelson: from n/a through <= 1.2.0.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:21 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22502

WordPress Mr. Cobbler theme <= 1.1.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mr. Cobbler mr-cobbler allows PHP Local File Inclusion.This issue affects Mr. Cobbler: from n/a through <= 1.1.9.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:21 WIB

Official record

CritPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22500

WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:21 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22499

WordPress Lella theme <= 1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Lella lella allows PHP Local File Inclusion.This issue affects Lella: from n/a through <= 1.2.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:20 WIB

Official record

HighPublished 25 Mar 2026, 23:14 WIB

CVE-2026-22498

WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through <= 3.1.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 00:20 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage