CVE-2026-104747

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress-extensions

Products

Haaken Haaken

CVE-2026-66653

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Barista Wordpress

CVE-2026-40735

WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Reina Wordpress

CVE-2026-39539

WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Alloggio Hotel Booking Wordpress

CVE-2026-40736

WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Laurits Wordpress

CVE-2026-40760

WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Behold Wordpress

CVE-2026-40761

WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Valeska Wordpress

CVE-2026-40738

WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Eldon Wordpress

CVE-2026-32510

WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Kamperen Wordpress

CVE-2026-32506

WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Archicon Wordpress

CVE-2026-32509

WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Gracey Wordpress

CVE-2025-68987

WordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a through <= 2.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Cinerama Wordpress

CVE-2025-64287

WordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Alloggio Hotel Booking Wordpress

CVE-2026-32512

WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Pelicula Wordpress

CVE-2025-62868

WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Edge Cpt Wordpress

CVE-2025-69410

WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Belletrist belletrist allows PHP Local File Inclusion.This issue affects Belletrist: from n/a through <= 1.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Belletrist Wordpress