CVE-2026-22xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

795 records · Page 5 of 8

• CVE-2026-22493: WordPress Gaspard theme <= 1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gaspard gaspard allows PHP Local File Inclusion.This issue affects Gaspard: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-22492: WordPress Docket Cache plugin <= 24.07.04 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Docket Cache: from n/a through <= 24.07.04.

  Updated 2026-04-28
• CVE-2026-22491: WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.

  Updated 2026-04-28
• CVE-2026-22490: WordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Landing Page Creator for WordPress LPagery: from n/a through <= 2.4.9.

  Updated 2026-04-28
• CVE-2026-22489: WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider Slideshow: from n/a through <= 1.8.

  Updated 2026-04-28
• CVE-2026-22488: WordPress Dashboard Welcome for Beaver Builder plugin <= 1.0.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through <= 1.0.8.

  Updated 2026-04-28
• CVE-2026-22487: WordPress Speed Kit plugin <= 2.0.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed Kit: from n/a through <= 2.0.2.

  Updated 2026-04-28
• CVE-2026-22486: WordPress Re Gallery plugin <= 1.18.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n/a through 1.18.9.

  Updated 2026-04-29
• CVE-2026-22485: WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability 6.5 Medium

  Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.

  Updated 2026-04-28
• CVE-2026-22484: WordPress Lisfinity Core plugin <= 1.5.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pebas Lisfinity Core lisfinity-core allows SQL Injection.This issue affects Lisfinity Core: from n/a through <= 1.5.0.

  Updated 2026-04-28
• CVE-2026-22483: WordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a through <= 9.0.12.

  Updated 2026-04-28
• CVE-2026-22482: WordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12.

  Updated 2026-04-28
• CVE-2026-22481: WordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BD Courier Order Ratio Checker: from n/a through <= 2.0.1.

  Updated 2026-04-28
• CVE-2026-22480: WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability 7.2 High

  Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.

  Updated 2026-04-28
• CVE-2026-22479: WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.4.0.

  Updated 2026-04-28
• CVE-2026-22478: WordPress FindAll theme <= 1.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes FindAll findall allows PHP Local File Inclusion.This issue affects FindAll: from n/a through <= 1.4.

  Updated 2026-04-28
• CVE-2026-22477: WordPress Felizia theme <= 1.3.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Felizia felizia allows PHP Local File Inclusion.This issue affects Felizia: from n/a through <= 1.3.4.

  Updated 2026-04-28
• CVE-2026-22476: WordPress Etchy theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Etchy etchy allows PHP Local File Inclusion.This issue affects Etchy: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22475: WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.

  Updated 2026-04-28
• CVE-2026-22474: WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2026-22473: WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.

  Updated 2026-04-28
• CVE-2026-22472: WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.

  Updated 2026-04-28
• CVE-2026-22471: WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2026-22470: WordPress FireStorm Professional Real Estate plugin <= 2.7.11 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin allows Blind SQL Injection.This issue affects FireStorm Professional Real Estate: from n/a through <= 2.7.11.

  Updated 2026-04-28
• CVE-2026-22469: WordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This issue affects DeepDigital: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2026-22468: WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Absolute Addons For Elementor: from n/a through <= 1.0.14.

  Updated 2026-04-28
• CVE-2026-22467: WordPress DeepDigital theme <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mwtemplates DeepDigital deepdigital allows Reflected XSS.This issue affects DeepDigital: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2026-22466: WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a through <= 3.0.3.

  Updated 2026-04-28
• CVE-2026-22465: WordPress BuddyApp theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen BuddyApp buddyapp allows Reflected XSS.This issue affects BuddyApp: from n/a through <= 1.9.2.

  Updated 2026-04-28
• CVE-2026-22464: WordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows PHP Local File Inclusion.This issue affects My auctions allegro: from n/a through <= 3.6.33.

  Updated 2026-04-28
• CVE-2026-22463: WordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored XSS.This issue affects Form to Chat App: from n/a through <= 1.2.5.

  Updated 2026-04-28
• CVE-2026-22462: WordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer allows Cross Site Request Forgery.This issue affects Add Polylang support for Customizer: from n/a through <= 1.4.5.

  Updated 2026-04-28
• CVE-2026-22461: WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.

  Updated 2026-04-28
• CVE-2026-22460: WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affects FormGent: from n/a through <= 1.7.0.

  Updated 2026-04-28
• CVE-2026-22459: WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through <= 2.1.2.

  Updated 2026-04-28
• CVE-2026-22458: WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wanderland: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2026-22457: WordPress Wanderland theme <= 1.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2026-22456: WordPress Askka theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Askka askka allows PHP Local File Inclusion.This issue affects Askka: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22455: WordPress Thebe theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree Thebe thebe allows Reflected XSS.This issue affects Thebe: from n/a through <= 1.3.0.

  Updated 2026-04-28
• CVE-2026-22454: WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.

  Updated 2026-04-28
• CVE-2026-22453: WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2026-22452: WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hoverex hoverex allows PHP Local File Inclusion.This issue affects Hoverex: from n/a through <= 1.5.10.

  Updated 2026-04-28
• CVE-2026-22451: WordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.

  Updated 2026-04-28
• CVE-2026-22450: WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-22449: WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allows PHP Local File Inclusion.This issue affects Don Peppe: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-22448: WordPress PitchPrint plugin <= 11.1.2 - Arbitrary File Deletion vulnerability 7.5 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in flexcubed PitchPrint pitchprint allows Path Traversal.This issue affects PitchPrint: from n/a through <= 11.1.2.

  Updated 2026-04-28
• CVE-2026-22447: WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prowess: from n/a through <= 1.8.1.

  Updated 2026-04-28
• CVE-2026-22446: WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 1.8.1.

  Updated 2026-04-28
• CVE-2026-22445: WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.

  Updated 2026-04-28
• CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests 7.1 High

  The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .  These read-only ac

  Updated 2026-01-21
• CVE-2026-22443: WordPress Alliance theme <= 3.1.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Alliance alliance allows PHP Local File Inclusion.This issue affects Alliance: from n/a through <= 3.1.1.

  Updated 2026-04-28
• CVE-2026-22442: WordPress Tribe theme <= 1.7.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LaunchandSell Tribe tribe allows PHP Local File Inclusion.This issue affects Tribe: from n/a through <= 1.7.3.

  Updated 2026-04-28
• CVE-2026-22441: WordPress Zentrum theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Zentrum zentrum allows PHP Local File Inclusion.This issue affects Zentrum: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22440: WordPress Thecs theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree Thecs thecs allows Reflected XSS.This issue affects Thecs: from n/a through <= 1.4.7.

  Updated 2026-04-28
• CVE-2026-22439: WordPress Green Planet theme <= 1.1.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Green Planet green-planet allows PHP Local File Inclusion.This issue affects Green Planet: from n/a through <= 1.1.14.

  Updated 2026-04-28
• CVE-2026-22438: WordPress TheBi theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheBi thebi allows Reflected XSS.This issue affects TheBi: from n/a through <= 1.0.5.

  Updated 2026-04-28
• CVE-2026-22437: WordPress Playa theme <= 1.3.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Playa playa allows PHP Local File Inclusion.This issue affects Playa: from n/a through <= 1.3.9.

  Updated 2026-04-28
• CVE-2026-22436: WordPress Helvig theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Helvig helvig allows PHP Local File Inclusion.This issue affects Helvig: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22435: WordPress ElectroServ theme <= 1.3.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ElectroServ electroserv allows PHP Local File Inclusion.This issue affects ElectroServ: from n/a through <= 1.3.2.

  Updated 2026-04-28
• CVE-2026-22434: WordPress Crown Art theme <= 1.2.11 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Crown Art crown-art allows PHP Local File Inclusion.This issue affects Crown Art: from n/a through <= 1.2.11.

  Updated 2026-04-28
• CVE-2026-22433: WordPress CloudMe theme <= 1.2.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CloudMe cloudme allows PHP Local File Inclusion.This issue affects CloudMe: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2026-22432: WordPress Woopy theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Woopy woopy allows PHP Local File Inclusion.This issue affects Woopy: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22431: WordPress Wabi-Sabi theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wabi-Sabi wabi-sabi allows PHP Local File Inclusion.This issue affects Wabi-Sabi: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22430: WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2026-22429: WordPress Verdure theme <= 1.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Verdure verdure allows PHP Local File Inclusion.This issue affects Verdure: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2026-22428: WordPress Tooth Fairy theme <= 1.16 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tooth Fairy tooth-fairy allows PHP Local File Inclusion.This issue affects Tooth Fairy: from n/a through <= 1.16.

  Updated 2026-04-28
• CVE-2026-22427: WordPress GoTravel theme <= 2.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes GoTravel gotravel allows PHP Local File Inclusion.This issue affects GoTravel: from n/a through <= 2.1.

  Updated 2026-04-28
• CVE-2026-22426: WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22425: WordPress Sweet Jane theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Sweet Jane sweetjane allows PHP Local File Inclusion.This issue affects Sweet Jane: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22424: WordPress Shaha theme <= 1.1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Shaha shaha allows PHP Local File Inclusion.This issue affects Shaha: from n/a through <= 1.1.2.

  Updated 2026-04-28
• CVE-2026-22423: WordPress SetSail theme <= 1.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 1.8.

  Updated 2026-04-28
• CVE-2026-22422: WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This issue affects Everest Forms: from n/a through <= 3.4.1.

  Updated 2026-04-28
• CVE-2026-22421: WordPress Quantum theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Quantum quantum allows PHP Local File Inclusion.This issue affects Quantum: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22420: WordPress Horizon theme <= 1.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Horizon horizon allows PHP Local File Inclusion.This issue affects Horizon: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2026-22419: WordPress Honor theme <= 2.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Honor honor allows PHP Local File Inclusion.This issue affects Honor: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2026-22418: WordPress Great Lotus theme <= 1.3.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Great Lotus great-lotus allows PHP Local File Inclusion.This issue affects Great Lotus: from n/a through <= 1.3.1.

  Updated 2026-04-28
• CVE-2026-22417: WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

  Updated 2026-04-28
• CVE-2026-22416: WordPress FixTeam theme <= 1.5.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes FixTeam fixteam allows PHP Local File Inclusion.This issue affects FixTeam: from n/a through <= 1.5.0.

  Updated 2026-04-28
• CVE-2026-22415: WordPress The Mounty theme <= 1.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes The Mounty the-mounty allows PHP Local File Inclusion.This issue affects The Mounty: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2026-22414: WordPress Marra theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Marra marra allows PHP Local File Inclusion.This issue affects Marra: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22413: WordPress Malgré theme <= 1.0.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Malgré malgre allows PHP Local File Inclusion.This issue affects Malgré: from n/a through <= 1.0.3.

  Updated 2026-04-28
• CVE-2026-22412: WordPress Eona theme <= 1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Eona eona allows PHP Local File Inclusion.This issue affects Eona: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-22411: WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2026-22410: WordPress Dolcino theme <= 1.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dolcino dolcino allows PHP Local File Inclusion.This issue affects Dolcino: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2026-22409: WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22408: WordPress Justicia theme <= 1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Justicia justicia allows PHP Local File Inclusion.This issue affects Justicia: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-22407: WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.

  Updated 2026-04-28
• CVE-2026-22406: WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-22405: WordPress Overton theme <= 1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Overton overton allows PHP Local File Inclusion.This issue affects Overton: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2026-22404: WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2026-22403: WordPress Innovio theme <= 1.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Innovio innovio allows PHP Local File Inclusion.This issue affects Innovio: from n/a through <= 1.9.

  Updated 2026-04-28
• CVE-2026-22402: WordPress Triply theme <= 2.4.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Triply triply allows PHP Local File Inclusion.This issue affects Triply: from n/a through <= 2.4.7.

  Updated 2026-04-28
• CVE-2026-22401: WordPress Freshio theme <= 2.4.2 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Freshio freshio allows PHP Local File Inclusion.This issue affects Freshio: from n/a through <= 2.4.2.

  Updated 2026-04-28
• CVE-2026-22400: WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2026-22399: WordPress Holmes theme <= 1.7 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Holmes holmes allows PHP Local File Inclusion.This issue affects Holmes: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2026-22398: WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.

  Updated 2026-04-28
• CVE-2026-22397: WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Fleur fleur allows PHP Local File Inclusion.This issue affects Fleur: from n/a through <= 2.2.1.

  Updated 2026-04-28
• CVE-2026-22396: WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22395: WordPress Fiorello theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Fiorello fiorello allows PHP Local File Inclusion.This issue affects Fiorello: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2026-22394: WordPress Evently theme <= 1.7 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Evently evently allows PHP Local File Inclusion.This issue affects Evently: from n/a through <= 1.7.

  Updated 2026-04-28

Search a CVE ID or check dependency files →