Wordpress CVEs and Security Vulnerabilities

Export limit exceeded: 26253 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

CVE-2026-22331

WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Autoparts Wordpress

CVE-2026-22338

WordPress EcoBlue theme <= 1.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Ecoblue Wordpress

CVE-2026-25446

WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wishlist Products Wordpress

Products

Wishlist Member X Wordpress

CVE-2026-39558

WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Malmö Wordpress

CVE-2026-40735

WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Edge-themes Wordpress

Products

Reina Wordpress

CVE-2026-45436

WordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Rain-task Wordpress

Products

Wpbakery Page Builder Wordpress

CVE-2025-31013

WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themify Wordpress

Products

Themify Folo Wordpress

CVE-2025-69106

WordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Imba Wordpress

CVE-2025-69111

WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Reisen Wordpress

CVE-2025-69120

WordPress Dazzle theme <= 1.0.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Dazzle Wordpress

CVE-2025-69123

WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Snow Club Wordpress

CVE-2025-69126

WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Fortius Wordpress

CVE-2025-69127

WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Plumbing Wordpress

CVE-2025-69157

WordPress Gamic theme <= 1.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Gamic Wordpress

CVE-2025-69158

WordPress Granola theme <= 1.13 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Granola Wordpress

CVE-2025-69166

WordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Gunslinger Wordpress

CVE-2025-69174

WordPress Etude theme <= 1.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Etude Wordpress

CVE-2026-39523

WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Solene Core Wordpress

CVE-2026-39556

WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elated-themes Wordpress

Products

Konsept Wordpress

CVE-2026-39560

WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Hiroshi Wordpress

« first previous Page 156 of 820. next last »