CVE-2026-28024

WordPress Helion theme <= 1.1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Helion helion allows PHP Local File Inclusion.This issue affects Helion: from n/a through <= 1.1.12.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

Helion Wordpress

CVE-2026-28025

WordPress Stargaze theme <= 1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Stargaze stargaze allows PHP Local File Inclusion.This issue affects Stargaze: from n/a through <= 1.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Stargaze Wordpress

CVE-2026-28026

WordPress Motorix theme <= 1.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Motorix motorix allows PHP Local File Inclusion.This issue affects Motorix: from n/a through <= 1.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Motorix Wordpress

CVE-2026-28027

WordPress Kayon theme <= 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Kayon kayon allows PHP Local File Inclusion.This issue affects Kayon: from n/a through <= 1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Kayon Wordpress

CVE-2026-28028

WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through <= 1.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Moneyflow Wordpress

CVE-2026-28029

WordPress EmojiNation theme <= 1.0.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX EmojiNation emojination allows PHP Local File Inclusion.This issue affects EmojiNation: from n/a through <= 1.0.12.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Emojination Wordpress

CVE-2026-28030

WordPress Bonbon theme <= 1.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bonbon bonbon allows PHP Local File Inclusion.This issue affects Bonbon: from n/a through <= 1.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Bonbon Wordpress

CVE-2026-28031

WordPress Invetex theme <= 2.18 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Invetex invetex allows PHP Local File Inclusion.This issue affects Invetex: from n/a through <= 2.18.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Invetex Wordpress

CVE-2026-28032

WordPress Tuning theme <= 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tuning tuning allows PHP Local File Inclusion.This issue affects Tuning: from n/a through <= 1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Tuning Wordpress

CVE-2026-28033

WordPress Edifice theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Edifice edifice allows PHP Local File Inclusion.This issue affects Edifice: from n/a through <= 1.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Edifice Wordpress

CVE-2026-28034

WordPress Progress theme <= 1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Progress progress allows PHP Local File Inclusion.This issue affects Progress: from n/a through <= 1.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Progress Wordpress

CVE-2026-28035

WordPress Printy theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Printy printy allows PHP Local File Inclusion.This issue affects Printy: from n/a through <= 1.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Printy Wordpress

CVE-2026-28061

WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tiger Claw tiger-claw allows PHP Local File Inclusion.This issue affects Tiger Claw: from n/a through <= 1.1.14.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Tiger Claw Wordpress

CVE-2026-28041

WordPress Grit theme <= 1.0.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Grit grit allows PHP Local File Inclusion.This issue affects Grit: from n/a through <= 1.0.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ancorathemes Wordpress

Products

Grit Wordpress

CVE-2026-28060

WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX S.King stephanie-king allows PHP Local File Inclusion.This issue affects S.King: from n/a through <= 1.5.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

S.king Wordpress

CVE-2026-28043

WordPress Healer - Doctor, Clinic & Medical WordPress Theme theme <= 1.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer allows PHP Local File Inclusion.This issue affects Healer - Doctor, Clinic & Medical WordPress Theme: from n/a through <= 1.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Healer - Doctor, Clinic & Medical Wordpress Theme Wordpress

CVE-2026-28045

WordPress N7 | Golf Club Sports & Events theme <= 2.16.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX N7 | Golf Club Sports & Events n7-golf-club allows PHP Local File Inclusion.This issue affects N7 | Golf Club Sports & Events: from n/a through <= 2.16.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

N7 | Golf Club Sports & Events Wordpress

CVE-2026-28046

WordPress Law Office theme <= 3.3.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Law Office law-office allows PHP Local File Inclusion.This issue affects Law Office: from n/a through <= 3.3.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Law Office Wordpress

CVE-2026-28047

WordPress Victo theme <= 1.4.16 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through <= 1.4.16.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Magentech Wordpress

Products

Victo Wordpress

CVE-2026-28048

WordPress FlashMart theme <= 2.0.15 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech FlashMart flashmart allows PHP Local File Inclusion.This issue affects FlashMart: from n/a through <= 2.0.15.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Magentech Wordpress

Products

Flashmart Wordpress