CVE-2025-53302

WordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Constructor: from n/a through 1.6.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Anton Shevchuk Wordpress

Products

Constructor Wordpress

CVE-2025-53346

WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Core: from n/a through 2.3.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress

Products

Thim Core Wordpress

CVE-2025-53440

WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion. This issue affects Confidant: from n/a through 1.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Confidant Wordpress

CVE-2025-58024

WordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unboundstudio Wordpress

Products

Accordion Faq Wordpress

CVE-2025-58705

WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Crafti Wordpress

CVE-2026-42670

WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability

Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Etoile Web Design Incorporated Wordpress

Products

Five Star Restaurant Reservations Wordpress

CVE-2026-42684

WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress

Products

Wp Job Portal Wordpress

CVE-2026-42685

WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress

Products

Wp Job Portal Wordpress

CVE-2026-39550

WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Aperitif Wordpress

CVE-2026-39551

WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Töbel Wordpress

CVE-2026-39552

WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Code Supply Co. Wordpress

Products

Blueprint Wordpress

CVE-2026-39553

WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Waveride Wordpress

CVE-2025-58707

WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Spin Wordpress

CVE-2025-58897

WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Fermentio Wordpress

CVE-2025-69369

WordPress Racquet theme <= 1.12.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Racquet Wordpress

CVE-2025-68886

WordPress Cookiteer theme <= 1.4.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Androthemes Wordpress

Products

Cookiteer Wordpress

CVE-2026-27351

WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sekander Badsha Wordpress

Products

Crew Hrm Wordpress

CVE-2026-40780

WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress

Products

Bookit Wordpress

CVE-2026-8382

Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpengine

Products

Wordpress Advanced Custom Fields

CVE-2026-42683

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vikwp Wordpress

Products

Vikbooking Hotel Booking Engine & Pms Wordpress