CVE-2026-28xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

856 records · Page 8 of 9

• CVE-2026-28156: WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Do Lasso <= 358 versions.

  Updated 2026-08-13
• CVE-2026-28155: WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

  Updated 2026-08-13
• CVE-2026-28154: WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a

  Updated 2026-08-14
• CVE-2026-28153: WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.

  Updated 2026-08-24
• CVE-2026-28152: WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

  Updated 2026-08-24
• CVE-2026-28151: WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

  Updated 2026-08-24
• CVE-2026-28150: WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.

  Updated 2026-08-20
• CVE-2026-28149: WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

  Updated 2026-08-13
• CVE-2026-28148: WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability 9.8 Critical

  Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

  Updated 2026-08-13
• CVE-2026-28147: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15.

  Updated 2026-08-03
• CVE-2026-28146: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability 6.5 Medium

  Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

  Updated 2026-08-06
• CVE-2026-28145: WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability 5.3 Medium

  Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.

  Updated 2026-07-31
• CVE-2026-28144: WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability 4.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.

  Updated 2026-07-31
• CVE-2026-28143: WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  Updated 2026-08-06
• CVE-2026-28142: WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

  Updated 2026-08-13
• CVE-2026-28141: WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  Updated 2026-08-06
• CVE-2026-28140: WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

  Updated 2026-08-06
• CVE-2026-28139: WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

  Updated 2026-08-06
• CVE-2026-28138: WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability 7.2 High

  Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.

  Updated 2026-04-28
• CVE-2026-28137: WordPress MediCenter - Health Medical Clinic WordPress Theme theme <= 14.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Reflected XSS.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 14.9.

  Updated 2026-04-28
• CVE-2026-28136: WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue affects WP SMS: from n/a through <= 6.9.12.

  Updated 2026-04-28
• CVE-2026-28135: WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability 8.2 High

  Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.

  Updated 2026-04-29
• CVE-2026-28134: WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability 8.5 High

  Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

  Updated 2026-04-28
• CVE-2026-28133: WordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerability 8.5 High

  Unrestricted Upload of File with Dangerous Type vulnerability in WP Chill Filr filr-protection allows Upload a Web Shell to a Web Server.This issue affects Filr: from n/a through <= 1.2.14.

  Updated 2026-04-28
• CVE-2026-28132: WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.4.4.

  Updated 2026-04-28
• CVE-2026-28131: WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability 6.5 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through <= 1.14.4.

  Updated 2026-04-28
• CVE-2026-28130: WordPress UDesign theme <= 4.14.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign u-design allows Reflected XSS.This issue affects UDesign: from n/a through <= 4.14.0.

  Updated 2026-04-28
• CVE-2026-28129: WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Little Birdies little-birdies allows PHP Local File Inclusion.This issue affects Little Birdies: from n/a through <= 1.3.16.

  Updated 2026-04-28
• CVE-2026-28128: WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through <= 1.7.0.

  Updated 2026-04-28
• CVE-2026-28127: WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Lawyer Directory lawyer-directory allows Reflected XSS.This issue affects Lawyer Directory: from n/a through <= 1.3.2.

  Updated 2026-04-28
• CVE-2026-28126: WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam RH Frontend Publishing Pro rh-frontend allows Reflected XSS.This issue affects RH Frontend Publishing Pro: from n/a through < 4.3.4.

  Updated 2026-04-28
• CVE-2026-28125: WordPress Midi theme <= 1.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Midi midi allows PHP Local File Inclusion.This issue affects Midi: from n/a through <= 1.14.

  Updated 2026-04-28
• CVE-2026-28124: WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Notarius notarius allows PHP Local File Inclusion.This issue affects Notarius: from n/a through <= 1.9.

  Updated 2026-04-28
• CVE-2026-28123: WordPress Veil theme <= 1.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Veil veil allows PHP Local File Inclusion.This issue affects Veil: from n/a through <= 1.9.

  Updated 2026-04-28
• CVE-2026-28122: WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows Reflected XSS.This issue affects ListingPro: from n/a through <= 2.9.8.

  Updated 2026-04-28
• CVE-2026-28121: WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Anderson andersonclinic allows PHP Local File Inclusion.This issue affects Anderson: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2026-28120: WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dr.Patterson dr-patterson allows PHP Local File Inclusion.This issue affects Dr.Patterson: from n/a through <= 1.3.2.

  Updated 2026-04-28
• CVE-2026-28119: WordPress Nirvana theme <= 2.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Nirvana nir-vana allows PHP Local File Inclusion.This issue affects Nirvana: from n/a through <= 2.6.

  Updated 2026-04-28
• CVE-2026-28118: WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Welldone welldone allows PHP Local File Inclusion.This issue affects Welldone: from n/a through <= 2.4.

  Updated 2026-04-28
• CVE-2026-28117: WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through <= 2.9.

  Updated 2026-04-28
• CVE-2026-28116: WordPress Progress Planner plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.

  Updated 2026-06-02
• CVE-2026-28115: WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.

  Updated 2026-04-28
• CVE-2026-28114: WordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in firassaidi WooCommerce License Manager fs-license-manager allows Upload a Web Shell to a Web Server.This issue affects WooCommerce License Manager: from n/a through <= 7.0.6.

  Updated 2026-04-28
• CVE-2026-28113: WordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Reflected XSS.This issue affects Ultimate Learning Pro: from n/a through <= 3.9.1.

  Updated 2026-04-28
• CVE-2026-28112: WordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows Reflected XSS.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2026-28111: WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability 8.8 High

  Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

  Updated 2026-08-06
• CVE-2026-28110: WordPress LambertGroup - AllInOne - Banner with Playlist plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2026-28109: WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Reflected XSS.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2026-28108: WordPress LambertGroup - AllInOne - Banner with Thumbnails plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2026-28107: WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Muzicon muzicon allows PHP Local File Inclusion.This issue affects Muzicon: from n/a through <= 1.9.0.

  Updated 2026-04-28
• CVE-2026-28106: WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.

  Updated 2026-03-09
• CVE-2026-28105: WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.

  Updated 2026-04-28
• CVE-2026-28104: WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Aryan Shirani Bid Abadi Site Suggest site-suggest allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Site Suggest: from n/a through <= 1.3.9.

  Updated 2026-04-28
• CVE-2026-28103: WordPress LBG Zoominoutslider plugin <= 5.4.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows Reflected XSS.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.5.

  Updated 2026-04-28
• CVE-2026-28102: WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider Classic uberSlider_classic allows Reflected XSS.This issue affects UberSlider Classic: from n/a through <= 2.5.

  Updated 2026-04-28
• CVE-2026-28101: WordPress UberSlider MouseInteraction plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider MouseInteraction uberSlider_mouseinteraction allows Reflected XSS.This issue affects UberSlider MouseInteraction: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2026-28100: WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider PerpetuumMobile uberSlider_perpetuummobile allows Reflected XSS.This issue affects UberSlider PerpetuumMobile: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2026-28099: WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup UberSlider Ultra uberSlider_ultra allows Reflected XSS.This issue affects UberSlider Ultra: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2026-28098: WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Save Life save-life allows PHP Local File Inclusion.This issue affects Save Life: from n/a through <= 1.2.13.

  Updated 2026-04-28
• CVE-2026-28097: WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Artrium artrium allows PHP Local File Inclusion.This issue affects Artrium: from n/a through <= 1.0.14.

  Updated 2026-04-28
• CVE-2026-28096: WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX WealthCo wealthco allows PHP Local File Inclusion.This issue affects WealthCo: from n/a through <= 2.18.

  Updated 2026-04-28
• CVE-2026-28095: WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Marcell marcell allows PHP Local File Inclusion.This issue affects Marcell: from n/a through <= 1.2.14.

  Updated 2026-04-28
• CVE-2026-28094: WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX RexCoin rexcoin allows PHP Local File Inclusion.This issue affects RexCoin: from n/a through <= 1.2.6.

  Updated 2026-04-28
• CVE-2026-28093: WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Ozisti ozisti allows PHP Local File Inclusion.This issue affects Ozisti: from n/a through <= 1.1.10.

  Updated 2026-04-28
• CVE-2026-28092: WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Sounder sounder allows PHP Local File Inclusion.This issue affects Sounder: from n/a through <= 1.3.11.

  Updated 2026-04-28
• CVE-2026-28091: WordPress Coleo theme <= 1.1.7 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Coleo coleo allows PHP Local File Inclusion.This issue affects Coleo: from n/a through <= 1.1.7.

  Updated 2026-04-28
• CVE-2026-28090: WordPress Gamezone theme <= 1.1.11 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gamezone gamezone allows PHP Local File Inclusion.This issue affects Gamezone: from n/a through <= 1.1.11.

  Updated 2026-04-28
• CVE-2026-28089: WordPress Daiquiri theme <= 1.2.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Daiquiri daiquiri allows PHP Local File Inclusion.This issue affects Daiquiri: from n/a through <= 1.2.4.

  Updated 2026-04-28
• CVE-2026-28088: WordPress Aqualots theme <= 1.1.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Aqualots aqualots allows PHP Local File Inclusion.This issue affects Aqualots: from n/a through <= 1.1.6.

  Updated 2026-04-28
• CVE-2026-28087: WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Filmax filmax allows PHP Local File Inclusion.This issue affects Filmax: from n/a through <= 1.1.11.

  Updated 2026-04-28
• CVE-2026-28086: WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Run Gran run-gran allows PHP Local File Inclusion.This issue affects Run Gran: from n/a through <= 2.0.

  Updated 2026-04-28
• CVE-2026-28085: WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Mahogany mahogany allows PHP Local File Inclusion.This issue affects Mahogany: from n/a through <= 2.9.

  Updated 2026-04-28
• CVE-2026-28084: WordPress Bazinga theme <= 1.1.9 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bazinga bazinga allows PHP Local File Inclusion.This issue affects Bazinga: from n/a through <= 1.1.9.

  Updated 2026-04-28
• CVE-2026-28083: WordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Stored XSS.This issue affects Flatsome: from n/a through <= 3.20.5.

  Updated 2026-04-28
• CVE-2026-28082: WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  Updated 2026-08-06
• CVE-2026-28081: WordPress Windsor theme <= 2.5.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Windsor windsor allows PHP Local File Inclusion.This issue affects Windsor: from n/a through <= 2.5.0.

  Updated 2026-04-28
• CVE-2026-28080: WordPress Rank Math SEO PRO plugin <= 3.0.95 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO PRO: from n/a through 3.0.95.

  Updated 2026-04-28
• CVE-2026-28079: WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Conquerors conquerors allows PHP Local File Inclusion.This issue affects Conquerors: from n/a through <= 1.2.13.

  Updated 2026-04-28
• CVE-2026-28078: WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability 4.9 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through <= 2.2.0.

  Updated 2026-04-28
• CVE-2026-28077: WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Vapester vapester allows PHP Local File Inclusion.This issue affects Vapester: from n/a through <= 1.1.10.

  Updated 2026-04-28
• CVE-2026-28076: WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Frenify Guff guff allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Guff: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2026-28075: WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto porto allows Reflected XSS.This issue affects Porto: from n/a through <= 7.6.2.

  Updated 2026-04-28
• CVE-2026-28074: WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.

  Updated 2026-04-28
• CVE-2026-28073: WordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS.This issue affects WP eMember: from n/a through v10.2.2.

  Updated 2026-04-28
• CVE-2026-28072: WordPress pixfort Core plugin <= 3.2.22 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixFort pixfort Core pixfort-core allows Reflected XSS.This issue affects pixfort Core: from n/a through <= 3.2.22.

  Updated 2026-04-28
• CVE-2026-28071: WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability 6.3 Medium

  Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pixfort Core: from n/a through <= 3.2.22.

  Updated 2026-04-28
• CVE-2026-28070: WordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Tips and Tricks HQ WP eMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP eMember: from n/a through v10.2.2.

  Updated 2026-04-28
• CVE-2026-28069: WordPress Le Truffe theme <= 1.1.7 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Le Truffe letruffe allows PHP Local File Inclusion.This issue affects Le Truffe: from n/a through <= 1.1.7.

  Updated 2026-04-28
• CVE-2026-28068: WordPress Rhythmo theme <= 1.3.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Rhythmo rhythmo allows PHP Local File Inclusion.This issue affects Rhythmo: from n/a through <= 1.3.4.

  Updated 2026-04-28
• CVE-2026-28067: WordPress Bassein theme <= 1.0.15 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bassein bassein allows PHP Local File Inclusion.This issue affects Bassein: from n/a through <= 1.0.15.

  Updated 2026-04-28
• CVE-2026-28066: WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through <= 2.17.

  Updated 2026-04-28
• CVE-2026-28065: WordPress Eject theme <= 2.17 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Eject eject allows PHP Local File Inclusion.This issue affects Eject: from n/a through <= 2.17.

  Updated 2026-04-28
• CVE-2026-28064: WordPress Edge Decor theme <= 2.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Edge Decor edge-decor allows PHP Local File Inclusion.This issue affects Edge Decor: from n/a through <= 2.2.

  Updated 2026-04-28
• CVE-2026-28063: WordPress Asia Garden theme <= 1.3.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Asia Garden asia-garden allows PHP Local File Inclusion.This issue affects Asia Garden: from n/a through <= 1.3.1.

  Updated 2026-04-28
• CVE-2026-28062: WordPress Happy Baby theme <= 1.2.12 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through <= 1.2.12.

  Updated 2026-04-28
• CVE-2026-28061: WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tiger Claw tiger-claw allows PHP Local File Inclusion.This issue affects Tiger Claw: from n/a through <= 1.1.14.

  Updated 2026-04-28
• CVE-2026-28060: WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX S.King stephanie-king allows PHP Local File Inclusion.This issue affects S.King: from n/a through <= 1.5.3.

  Updated 2026-04-28
• CVE-2026-28059: WordPress Dermatology Clinic theme <= 1.4.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dermatology Clinic dermatology-clinic allows PHP Local File Inclusion.This issue affects Dermatology Clinic: from n/a through <= 1.4.3.

  Updated 2026-04-28
• CVE-2026-28058: WordPress Dixon theme <= 1.4.2.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dixon dixon allows PHP Local File Inclusion.This issue affects Dixon: from n/a through <= 1.4.2.1.

  Updated 2026-04-28
• CVE-2026-28057: WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Mandala mandala allows PHP Local File Inclusion.This issue affects Mandala: from n/a through <= 2.8.

  Updated 2026-04-28

Search a CVE ID or check dependency files →