WordPress Vulnerability Report

WordPress Vulnerability Report — March 4, 2026

Since last week, 281 new vulnerabilities have emerged in the WordPress ecosystem, including 108 plugins and 173 themes. Of those, 225 remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Avatar photo
Sarah Ulmer

Published:Mar 4, 2026

Filed Under:WordPress Vulnerability Report

Reading Time:44 min.

In this report, 281 vulnerabilities have been publicly disclosed. Security patches for 56 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 225 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 7.0 Beta 2 is now available for testing. As this is a pre-release version, it is intended for testing and development only and should not be installed on production or mission-critical sites. Organizations should use local or staging environments to evaluate compatibility and new features before the final rollout.

The full release of WordPress 7.0 is currently scheduled for April 9, 2026. You can find the complete release schedule and technical testing details in the official announcement.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 50 Patched / 58 Unpatched

W3 Total Cache

Plugin:
W3 Total Cache
Plugin Slug:
w3-total-cache
Installations
900,000+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27384
The vulnerability has not been patched. You should deactivate the plugin.

SiteGuard WP Plugin

Plugin:
SiteGuard WP Plugin
Plugin Slug:
siteguard
Installations
600,000+
Vulnerability:
Bypass Vulnerability
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27411
The vulnerability has not been patched. You should deactivate the plugin.

NextScripts: Social Networks Auto-Poster

Plugin:
NextScripts: Social Networks Auto-Poster
Plugin Slug:
social-networks-auto-poster-facebook-twitter-g
Installations
30,000+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27379
The vulnerability has not been patched. You should deactivate the plugin.

Builderall for WordPress

Plugin:
Builderall for WordPress
Plugin Slug:
builderall-cheetah-for-wp
Installations
1,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-22390
The vulnerability has not been patched. You should deactivate the plugin.

Directory Listings WordPress plugin – uListing

Plugin:
Directory Listings WordPress plugin – uListing
Plugin Slug:
ulisting
Installations
1,000+
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28078
The vulnerability has not been patched. You should deactivate the plugin.

Filr – Secure document library

Plugin:
Filr – Secure document library
Plugin Slug:
filr-protection
Installations
800+
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28133
The vulnerability has not been patched. You should deactivate the plugin.

Scientific and Interactive Blocks – inseri core

Plugin:
Scientific and Interactive Blocks – inseri core
Plugin Slug:
inseri-core
Installations
80+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27344
The vulnerability has not been patched. You should deactivate the plugin.

Site Suggest

Plugin:
Site Suggest
Plugin Slug:
site-suggest
Installations
30+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28104
The vulnerability has not been patched. You should deactivate the plugin.

Super Stage WP

Plugin:
Super Stage WP
Plugin Slug:
super-stage-wp
Installations
10+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-1542
The vulnerability has not been patched. You should deactivate the plugin.

WP Attractive Donations System – Easy Stripe & Paypal donations

Plugin:
WP Attractive Donations System – Easy Stripe & Paypal donations
Plugin Slug:
WP_AttractiveDonationsSystem
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28115
The vulnerability has not been patched. You should deactivate the plugin.

AllInOne – Banner Rotator

Plugin:
AllInOne – Banner Rotator
Plugin Slug:
all-in-one-bannerRotator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28112
The vulnerability has not been patched. You should deactivate the plugin.

LambertGroup – AllInOne – Banner with Playlist

Plugin:
LambertGroup – AllInOne – Banner with Playlist
Plugin Slug:
all-in-one-bannerWithPlaylist
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28110
The vulnerability has not been patched. You should deactivate the plugin.

LambertGroup – AllInOne – Content Slider

Plugin:
LambertGroup – AllInOne – Content Slider
Plugin Slug:
all-in-one-contentSlider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28109
The vulnerability has not been patched. You should deactivate the plugin.

LambertGroup – AllInOne – Banner with Thumbnails

Plugin:
LambertGroup – AllInOne – Banner with Thumbnails
Plugin Slug:
all-in-one-thumbnailsBanner
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28108
The vulnerability has not been patched. You should deactivate the plugin.

Awa Plugins

Plugin:
Awa Plugins
Plugin Slug:
awa-plugins
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27359
The vulnerability has not been patched. You should deactivate the plugin.

Cost Calculator Pro

Plugin:
Cost Calculator Pro
Plugin Slug:
cost-calculator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2506
The vulnerability has not been patched. You should deactivate the plugin.
Plugin:
Custom Logo
Plugin Slug:
custom-logo
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2499
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Booking Manager

Plugin:
DesignThemes Booking Manager
Plugin Slug:
designthemes-booking-manager
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27388
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Directory Addon

Plugin:
DesignThemes Directory Addon
Plugin Slug:
designthemes-directory-addon
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27386
The vulnerability has not been patched. You should deactivate the plugin.

DesignThemes Portfolio

Plugin:
DesignThemes Portfolio
Plugin Slug:
designthemes-portfolio
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27385
The vulnerability has not been patched. You should deactivate the plugin.

Directory Pro

Plugin:
Directory Pro
Plugin Slug:
directory-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27396
The vulnerability has not been patched. You should deactivate the plugin.

Eagle Booking

Plugin:
Eagle Booking
Plugin Slug:
eagle-booking
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27428
The vulnerability has not been patched. You should deactivate the plugin.

Easy Author Image

Plugin:
Easy Author Image
Plugin Slug:
easy-author-image
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1373
The vulnerability has not been patched. You should deactivate the plugin.

Electric Enquiries

Plugin:
Electric Enquiries
Plugin Slug:
electric-enquiries
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-14142
The vulnerability has not been patched. You should deactivate the plugin.

EventON

Plugin:
EventON
Plugin Slug:
eventon
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28037
The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Learning Pro

Plugin:
Ultimate Learning Pro
Plugin Slug:
indeed-learning-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28113
The vulnerability has not been patched. You should deactivate the plugin.

iXML

Plugin:
iXML
Plugin Slug:
ixml
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-14076
The vulnerability has not been patched. You should deactivate the plugin.

Lawyer Directory

Plugin:
Lawyer Directory
Plugin Slug:
lawyer-directory
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28127
The vulnerability has not been patched. You should deactivate the plugin.

LBG Zoominoutslider

Plugin:
LBG Zoominoutslider
Plugin Slug:
lbg_zoominoutslider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28103
The vulnerability has not been patched. You should deactivate the plugin.

ListingPro

Plugin:
ListingPro
Plugin Slug:
listingpro-plugin
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28122
The vulnerability has not been patched. You should deactivate the plugin.

LMS Elementor Pro

Plugin:
LMS Elementor Pro
Plugin Slug:
lms-elementor-pro
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27983
The vulnerability has not been patched. You should deactivate the plugin.

OVRI Payment

Plugin:
OVRI Payment
Plugin Slug:
moneytigo
Vulnerability:
Backdoor
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-10938
The vulnerability has not been patched. You should deactivate the plugin.

Profile Builder Pro

Plugin:
Profile Builder Pro
Plugin Slug:
profile-builder-pro
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27413
The vulnerability has not been patched. You should deactivate the plugin.

Responsive Posts Carousel Pro

Plugin:
Responsive Posts Carousel Pro
Plugin Slug:
responsive-posts-carousel-pro
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27361
The vulnerability has not been patched. You should deactivate the plugin.

RH Frontend Publishing Pro

Plugin:
RH Frontend Publishing Pro
Plugin Slug:
rh-frontend
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28126
The vulnerability has not been patched. You should deactivate the plugin.

Rise Blocks

Plugin:
Rise Blocks
Plugin Slug:
rise-blocks
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1614
The vulnerability has not been patched. You should deactivate the plugin.

TP2WP Importer

Plugin:
TP2WP Importer
Plugin Slug:
tp2wp-importer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2489
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider Classic

Plugin:
UberSlider Classic
Plugin Slug:
uberSlider_classic
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28102
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider MouseInteraction

Plugin:
UberSlider MouseInteraction
Plugin Slug:
uberSlider_mouseinteraction
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28101
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider PerpetuumMobile

Plugin:
UberSlider PerpetuumMobile
Plugin Slug:
uberSlider_perpetuummobile
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28100
The vulnerability has not been patched. You should deactivate the plugin.

UberSlider Ultra

Plugin:
UberSlider Ultra
Plugin Slug:
uberSlider_ultra
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28099
The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Addons for WPBakery Page Builder

Plugin:
Ultimate Addons for WPBakery Page Builder
Plugin Slug:
ultimate_vc_addons
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28038
The vulnerability has not been patched. You should deactivate the plugin.

WP Bakery Autoresponder Addon

Plugin:
WP Bakery Autoresponder Addon
Plugin Slug:
vc-autoresponder-addon
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27362
The vulnerability has not been patched. You should deactivate the plugin.

WP Bakery Autoresponder Addon

Plugin:
WP Bakery Autoresponder Addon
Plugin Slug:
vc-autoresponder-addon
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27363
The vulnerability has not been patched. You should deactivate the plugin.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27389
The vulnerability has not been patched. You should deactivate the plugin.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27390
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Coming Soon Product with Countdown

Plugin:
WooCommerce Coming Soon Product with Countdown
Plugin Slug:
woo-coming-soon-product
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-27354
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Order Details

Plugin:
WooCommerce Order Details
Plugin Slug:
woocommerce-order-details
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27374
The vulnerability has not been patched. You should deactivate the plugin.

Worry Proof Backup

Plugin:
Worry Proof Backup
Plugin Slug:
worry-proof-backup
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1311
The vulnerability has not been patched. You should deactivate the plugin.

WP Ad Guru

Plugin:
WP Ad Guru
Plugin Slug:
wp-ad-guru
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-12411
The vulnerability has not been patched. You should deactivate the plugin.

Conditional CAPTCHA

Plugin:
Conditional CAPTCHA
Plugin Slug:
wp-conditional-captcha
Vulnerability:
Open Redirection
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-1369
The vulnerability has not been patched. You should deactivate the plugin.

WP eMember

Plugin:
WP eMember
Plugin Slug:
wp-eMember
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28073
The vulnerability has not been patched. You should deactivate the plugin.

WP Responsive Images

Plugin:
WP Responsive Images
Plugin Slug:
wp-responsive-images
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-1557
The vulnerability has not been patched. You should deactivate the plugin.

WP Social Meta

Plugin:
WP Social Meta
Plugin Slug:
wp-social-meta
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-2498
The vulnerability has not been patched. You should deactivate the plugin.

xmlrpc attacks blocker

Plugin:
xmlrpc attacks blocker
Plugin Slug:
xmlrpc-attacks-blocker
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-2502
The vulnerability has not been patched. You should deactivate the plugin.

The Events Calendar

Plugin:
The Events Calendar
Plugin Slug:
the-events-calendar
Installations
700,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.15.16.1
Severity Score:
Medium
CVE:
2026-2694
The vulnerability has been patched, so you should update to version 6.15.16.1.

Page Builder by SiteOrigin

Plugin:
Page Builder by SiteOrigin
Plugin Slug:
siteorigin-panels
Installations
500,000+
Vulnerability:
Local File Inclusion
Patched in Version:
2.34.0
Severity Score:
High
CVE:
2026-2448
The vulnerability has been patched, so you should update to version 2.34.0.

WP Mail Logging

Plugin:
WP Mail Logging
Plugin Slug:
wp-mail-logging
Installations
300,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.16
Severity Score:
Critical
CVE:
2026-2471
The vulnerability has been patched, so you should update to version 1.16.

Post Duplicator

Plugin:
Post Duplicator
Plugin Slug:
post-duplicator
Installations
200,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.9
Severity Score:
Medium
CVE:
2026-2301
The vulnerability has been patched, so you should update to version 3.0.9.

Disable Admin Notices – Hide Dashboard Notifications

Plugin:
Disable Admin Notices – Hide Dashboard Notifications
Plugin Slug:
disable-admin-notices
Installations
100,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.4.3
Severity Score:
Medium
CVE:
2026-2410
The vulnerability has been patched, so you should update to version 1.4.3.

Responsive Lightbox & Gallery

Plugin:
Responsive Lightbox & Gallery
Plugin Slug:
responsive-lightbox
Installations
100,000+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
2.7.2
Severity Score:
Medium
CVE:
2026-2479
The vulnerability has been patched, so you should update to version 2.7.2.

Responsive Lightbox & Gallery

Plugin:
Responsive Lightbox & Gallery
Plugin Slug:
responsive-lightbox
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.1
Severity Score:
High
CVE:
2025-15386
The vulnerability has been patched, so you should update to version 2.6.1.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
SQL Injection
Patched in Version:
3.9.7
Severity Score:
Critical
CVE:
2025-13673
The vulnerability has been patched, so you should update to version 3.9.7.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.6
Severity Score:
Medium
CVE:
2026-23799
The vulnerability has been patched, so you should update to version 3.9.6.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Broken Authentication
Patched in Version:
5.1.3
Severity Score:
High
CVE:
2026-1779
The vulnerability has been patched, so you should update to version 5.1.3.

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Plugin:
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Plugin Slug:
user-registration
Installations
60,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
5.1.3
Severity Score:
Medium
CVE:
2026-2356
The vulnerability has been patched, so you should update to version 5.1.3.

WP Accessibility

Plugin:
WP Accessibility
Plugin Slug:
wp-accessibility
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.2
Severity Score:
Medium
CVE:
2026-2362
The vulnerability has been patched, so you should update to version 2.3.2.

WP Recipe Maker

Plugin:
WP Recipe Maker
Plugin Slug:
wp-recipe-maker
Installations
50,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
10.3.3
Severity Score:
Medium
CVE:
2026-1558
The vulnerability has been patched, so you should update to version 10.3.3.

WP Recipe Maker

Plugin:
WP Recipe Maker
Plugin Slug:
wp-recipe-maker
Installations
50,000+
Vulnerability:
Broken Access Control
Patched in Version:
10.3.0
Severity Score:
Medium
CVE:
2025-14742
The vulnerability has been patched, so you should update to version 10.3.0.

Simple Membership

Plugin:
Simple Membership
Plugin Slug:
simple-membership
Installations
40,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.7.1
Severity Score:
Medium
CVE:
2026-1461
The vulnerability has been patched, so you should update to version 4.7.1.

PowerPress Podcasting plugin by Blubrry

Plugin:
PowerPress Podcasting plugin by Blubrry
Plugin Slug:
powerpress
Installations
30,000+
Vulnerability:
PHP Object Injection
Patched in Version:
11.15.11
Severity Score:
High
CVE:
2026-23798
The vulnerability has been patched, so you should update to version 11.15.11.

Xpro Addons — 140+ Widgets for Elementor

Plugin:
Xpro Addons — 140+ Widgets for Elementor
Plugin Slug:
xpro-elementor-addons
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.25
Severity Score:
Medium
CVE:
2025-14149
The vulnerability has been patched, so you should update to version 1.4.25.

Secure Copy Content Protection and Content Locking

Plugin:
Secure Copy Content Protection and Content Locking
Plugin Slug:
secure-copy-content-protection
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.0.2
Severity Score:
Medium
CVE:
2026-2367
The vulnerability has been patched, so you should update to version 5.0.2.

Simple Download Monitor

Plugin:
Simple Download Monitor
Plugin Slug:
simple-download-monitor
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.0.6
Severity Score:
Medium
CVE:
2026-2383
The vulnerability has been patched, so you should update to version 4.0.6.

WP Customer Reviews

Plugin:
WP Customer Reviews
Plugin Slug:
wp-customer-reviews
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.6
Severity Score:
High
CVE:
2025-14452
The vulnerability has been patched, so you should update to version 3.7.6.

WPZOOM Addons for Elementor – Starter Templates & Widgets

Plugin:
WPZOOM Addons for Elementor – Starter Templates & Widgets
Plugin Slug:
wpzoom-elementor-addons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.5
Severity Score:
High
CVE:
2026-2295
The vulnerability has been patched, so you should update to version 1.3.5.

Japanized for WooCommerce

Plugin:
Japanized for WooCommerce
Plugin Slug:
woocommerce-for-japan
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.8.5
Severity Score:
Medium
CVE:
2026-1305
The vulnerability has been patched, so you should update to version 2.8.5.

Analytics Cat – Google Analytics Made Easy

Plugin:
Analytics Cat – Google Analytics Made Easy
Plugin Slug:
analytics-cat
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.3
Severity Score:
High
CVE:
2024-12072
The vulnerability has been patched, so you should update to version 1.1.3.

Geo Mashup

Plugin:
Geo Mashup
Plugin Slug:
geo-mashup
Installations
2,000+
Vulnerability:
SQL Injection
Patched in Version:
1.13.18
Severity Score:
Critical
CVE:
2026-2416
The vulnerability has been patched, so you should update to version 1.13.18.

WPGSI: Spreadsheet Integration

Plugin:
WPGSI: Spreadsheet Integration
Plugin Slug:
wpgsi
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.8.4
Severity Score:
High
CVE:
2026-1916
The vulnerability has been patched, so you should update to version 3.8.4.

Ebook Store

Plugin:
Ebook Store
Plugin Slug:
ebook-store
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.8002
Severity Score:
High
CVE:
2024-12262
The vulnerability has been patched, so you should update to version 5.8002.

My Tickets – Accessible Event Ticketing

Plugin:
My Tickets – Accessible Event Ticketing
Plugin Slug:
my-tickets
Installations
700+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.1.1
Severity Score:
High
CVE:
2026-27406
The vulnerability has been patched, so you should update to version 2.1.1.

Theater for WordPress

Plugin:
Theater for WordPress
Plugin Slug:
theatre
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.19.1
Severity Score:
Medium
CVE:
2025-69343
The vulnerability has been patched, so you should update to version 0.19.1.

AI ChatBot with ChatGPT and Content Generator by AYS

Plugin:
AI ChatBot with ChatGPT and Content Generator by AYS
Plugin Slug:
ays-chatgpt-assistant
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.6
Severity Score:
Medium
CVE:
2026-1336
The vulnerability has been patched, so you should update to version 2.7.6.

MailArchiver

Plugin:
MailArchiver
Plugin Slug:
mailarchiver
Installations
100+
Vulnerability:
SQL Injection
Patched in Version:
4.5.1
Severity Score:
High
CVE:
2026-2831
The vulnerability has been patched, so you should update to version 4.5.1.

PKT1 Centro de envios

Plugin:
PKT1 Centro de envios
Plugin Slug:
pkt1-centro-de-envios
Installations
40+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.2.2
Severity Score:
High
CVE:
2024-11806
The vulnerability has been patched, so you should update to version 1.2.2.

Planaday API

Plugin:
Planaday API
Plugin Slug:
planaday-api
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.5
Severity Score:
High
CVE:
2024-11804
The vulnerability has been patched, so you should update to version 11.5.

Fluent Forms Pro Add On Pack

Plugin:
Fluent Forms Pro Add On Pack
Plugin Slug:
fluentformpro
Vulnerability:
Broken Access Control
Patched in Version:
6.1.18
Severity Score:
High
CVE:
2026-2428
The vulnerability has been patched, so you should update to version 6.1.18.

WooCommerce License Manager

Plugin:
WooCommerce License Manager
Plugin Slug:
fs-license-manager
Vulnerability:
Arbitrary File Upload
Patched in Version:
7.0.7
Severity Score:
Critical
CVE:
2026-28114
The vulnerability has been patched, so you should update to version 7.0.7.

JetEngine

Plugin:
JetEngine
Plugin Slug:
jet-engine
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
3.8.1.2
Severity Score:
High
CVE:
2026-28134
The vulnerability has been patched, so you should update to version 3.8.1.2.

pixfort Core

Plugin:
pixfort Core
Plugin Slug:
pixfort-core
Vulnerability:
Broken Access Control
Patched in Version:
3.2.26
Severity Score:
Medium
CVE:
2026-28071
The vulnerability has been patched, so you should update to version 3.2.26.

pixfort Core

Plugin:
pixfort Core
Plugin Slug:
pixfort-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.26
Severity Score:
High
CVE:
2026-28072
The vulnerability has been patched, so you should update to version 3.2.26.

Really Simple Security Pro

Plugin:
Really Simple Security Pro
Plugin Slug:
really-simple-ssl-pro
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
9.5.4.1
Severity Score:
Medium
CVE:
2026-27397
The vulnerability has been patched, so you should update to version 9.5.4.1.

Riode Core

Plugin:
Riode Core
Plugin Slug:
riode-core
Vulnerability:
SQL Injection
Patched in Version:
1.6.27
Severity Score:
Critical
CVE:
2025-69338
The vulnerability has been patched, so you should update to version 1.6.27.

WeDesignTech Ultimate Booking Addon

Plugin:
WeDesignTech Ultimate Booking Addon
Plugin Slug:
wedesigntech-ultimate-booking-addon
Vulnerability:
Broken Access Control
Patched in Version:
1.0.4
Severity Score:
High
CVE:
2025-69340
The vulnerability has been patched, so you should update to version 1.0.4.

WordPress Themes — 6 Patched / 167 Unpatched

Nirvana

Theme:
Nirvana
Theme Slug:
nirvana
Downloads
773,853
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28119
The vulnerability has not been patched. You should switch themes.

OsTende

Theme:
OsTende
Theme Slug:
ostende
Downloads
8,315
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27986
The vulnerability has not been patched. You should switch themes.

Alchemists

Theme:
Alchemists
Theme Slug:
alchemists
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27334
The vulnerability has not been patched. You should switch themes.

Aldo

Theme:
Aldo
Theme Slug:
aldo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27993
The vulnerability has not been patched. You should switch themes.

Alliance

Theme:
Alliance
Theme Slug:
alliance
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22443
The vulnerability has not been patched. You should switch themes.

Anderson

Theme:
Anderson
Theme Slug:
andersonclinic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28121
The vulnerability has not been patched. You should switch themes.

Aora

Theme:
Aora
Theme Slug:
aora
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27381
The vulnerability has not been patched. You should switch themes.

Apollo | Night Club, DJ Event WordPress Theme

Theme:
Apollo | Night Club, DJ Event WordPress Theme
Theme Slug:
apollo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27340
The vulnerability has not been patched. You should switch themes.

Aqualots

Theme:
Aqualots
Theme Slug:
aqualots
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28088
The vulnerability has not been patched. You should switch themes.

Architecturer

Theme:
Architecturer
Theme Slug:
architecturer
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27358
The vulnerability has not been patched. You should switch themes.

Artrium

Theme:
Artrium
Theme Slug:
artrium
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28097
The vulnerability has not been patched. You should switch themes.

Asia Garden

Theme:
Asia Garden
Theme Slug:
asia-garden
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28063
The vulnerability has not been patched. You should switch themes.

Aviana

Theme:
Aviana
Theme Slug:
aviana
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22387
The vulnerability has not been patched. You should switch themes.

Avventure

Theme:
Avventure
Theme Slug:
avventure
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27991
The vulnerability has not been patched. You should switch themes.

Bassein

Theme:
Bassein
Theme Slug:
bassein
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28067
The vulnerability has not been patched. You should switch themes.

Bazinga

Theme:
Bazinga
Theme Slug:
bazinga
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28084
The vulnerability has not been patched. You should switch themes.

Beacon

Theme:
Beacon
Theme Slug:
beacon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28050
The vulnerability has not been patched. You should switch themes.

Bonbon

Theme:
Bonbon
Theme Slug:
bonbon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28030
The vulnerability has not been patched. You should switch themes.

Buzz Stone | Magazine & Viral Blog WordPress Theme

Theme:
Buzz Stone | Magazine & Viral Blog WordPress Theme
Theme Slug:
buzzstone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27339
The vulnerability has not been patched. You should switch themes.

Celeste

Theme:
Celeste
Theme Slug:
celeste
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27369
The vulnerability has not been patched. You should switch themes.

Miller

Theme:
Miller
Theme Slug:
christine-miller
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28053
The vulnerability has not been patched. You should switch themes.

Chroma

Theme:
Chroma
Theme Slug:
chroma
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28020
The vulnerability has not been patched. You should switch themes.

Chronicle – Lifestyle Magazine & Blog WordPress Theme

Theme:
Chronicle – Lifestyle Magazine & Blog WordPress Theme
Theme Slug:
chronicle
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27337
The vulnerability has not been patched. You should switch themes.

Claue – Clean, Minimal Elementor WooCommerce Theme

Theme:
Claue – Clean, Minimal Elementor WooCommerce Theme
Theme Slug:
claue
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27376
The vulnerability has not been patched. You should switch themes.

CloudMe

Theme:
CloudMe
Theme Slug:
cloudme
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22433
The vulnerability has not been patched. You should switch themes.

Cocco

Theme:
Cocco
Theme Slug:
cocco
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22389
The vulnerability has not been patched. You should switch themes.

Coinpress

Theme:
Coinpress
Theme Slug:
coinpress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28007
The vulnerability has not been patched. You should switch themes.

Coleo

Theme:
Coleo
Theme Slug:
coleo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28091
The vulnerability has not been patched. You should switch themes.

ConFix

Theme:
ConFix
Theme Slug:
confix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27990
The vulnerability has not been patched. You should switch themes.

Conquerors

Theme:
Conquerors
Theme Slug:
conquerors
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28079
The vulnerability has not been patched. You should switch themes.

Consultor | Consulting, Accounting & Legal Counsel WordPress Theme

Theme:
Consultor | Consulting, Accounting & Legal Counsel WordPress Theme
Theme Slug:
consultor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27336
The vulnerability has not been patched. You should switch themes.

Cortex

Theme:
Cortex
Theme Slug:
cortex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22392
The vulnerability has not been patched. You should switch themes.

Craftis

Theme:
Craftis
Theme Slug:
craftis
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28021
The vulnerability has not been patched. You should switch themes.

Crown Art

Theme:
Crown Art
Theme Slug:
crown-art
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22434
The vulnerability has not been patched. You should switch themes.

Daiquiri

Theme:
Daiquiri
Theme Slug:
daiquiri
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28089
The vulnerability has not been patched. You should switch themes.

Dentario

Theme:
Dentario
Theme Slug:
dentario
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27439
The vulnerability has not been patched. You should switch themes.

Dermatology Clinic

Theme:
Dermatology Clinic
Theme Slug:
dermatology-clinic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28059
The vulnerability has not been patched. You should switch themes.

Dixon

Theme:
Dixon
Theme Slug:
dixon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28058
The vulnerability has not been patched. You should switch themes.

Dolcino

Theme:
Dolcino
Theme Slug:
dolcino
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22410
The vulnerability has not been patched. You should switch themes.

Dr.Patterson

Theme:
Dr.Patterson
Theme Slug:
dr-patterson
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28120
The vulnerability has not been patched. You should switch themes.

DroneX

Theme:
DroneX
Theme Slug:
dronex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28009
The vulnerability has not been patched. You should switch themes.

Edge Decor

Theme:
Edge Decor
Theme Slug:
edge-decor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28064
The vulnerability has not been patched. You should switch themes.

Edifice

Theme:
Edifice
Theme Slug:
edifice
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28033
The vulnerability has not been patched. You should switch themes.

Eject

Theme:
Eject
Theme Slug:
eject
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28065
The vulnerability has not been patched. You should switch themes.

Ekoterra – NonProfit, Green Energy & Ecology Theme

Theme:
Ekoterra – NonProfit, Green Energy & Ecology Theme
Theme Slug:
ekoterra
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27335
The vulnerability has not been patched. You should switch themes.

ElectroServ

Theme:
ElectroServ
Theme Slug:
electroserv
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22435
The vulnerability has not been patched. You should switch themes.

EmojiNation

Theme:
EmojiNation
Theme Slug:
emojination
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28029
The vulnerability has not been patched. You should switch themes.

Eona

Theme:
Eona
Theme Slug:
eona
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22412
The vulnerability has not been patched. You should switch themes.

Equadio

Theme:
Equadio
Theme Slug:
equadio
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27988
The vulnerability has not been patched. You should switch themes.

Evently

Theme:
Evently
Theme Slug:
evently
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22394
The vulnerability has not been patched. You should switch themes.

Filmax

Theme:
Filmax
Theme Slug:
filmax
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28087
The vulnerability has not been patched. You should switch themes.

Fiorello

Theme:
Fiorello
Theme Slug:
fiorello
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22395
The vulnerability has not been patched. You should switch themes.

FixTeam

Theme:
FixTeam
Theme Slug:
fixteam
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22416
The vulnerability has not been patched. You should switch themes.

FlashMart

Theme:
FlashMart
Theme Slug:
flashmart
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28048
The vulnerability has not been patched. You should switch themes.

Fleur

Theme:
Fleur
Theme Slug:
fleur
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22397
The vulnerability has not been patched. You should switch themes.

Foodie

Theme:
Foodie
Theme Slug:
foodie
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28022
The vulnerability has not been patched. You should switch themes.

Gamezone

Theme:
Gamezone
Theme Slug:
gamezone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28090
The vulnerability has not been patched. You should switch themes.

Gecko

Theme:
Gecko
Theme Slug:
gecko
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27375
The vulnerability has not been patched. You should switch themes.

Global Logistics

Theme:
Global Logistics
Theme Slug:
globallogistics
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28018
The vulnerability has not been patched. You should switch themes.

Good Energy

Theme:
Good Energy
Theme Slug:
goodenergy
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28105
The vulnerability has not been patched. You should switch themes.

GoTravel

Theme:
GoTravel
Theme Slug:
gotravel
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22427
The vulnerability has not been patched. You should switch themes.

Grand News

Theme:
Grand News
Theme Slug:
grandnews
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27353
The vulnerability has not been patched. You should switch themes.

Great Lotus

Theme:
Great Lotus
Theme Slug:
great-lotus
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22418
The vulnerability has not been patched. You should switch themes.

Green Planet

Theme:
Green Planet
Theme Slug:
green-planet
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22439
The vulnerability has not been patched. You should switch themes.

Green Thumb

Theme:
Green Thumb
Theme Slug:
greenthumb
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28017
The vulnerability has not been patched. You should switch themes.

Gridiron

Theme:
Gridiron
Theme Slug:
gridiron
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28012
The vulnerability has not been patched. You should switch themes.

Grit

Theme:
Grit
Theme Slug:
grit
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28041
The vulnerability has not been patched. You should switch themes.

Guff

Theme:
Guff
Theme Slug:
guff
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28076
The vulnerability has not been patched. You should switch themes.

Happy Baby

Theme:
Happy Baby
Theme Slug:
happy-baby
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28062
The vulnerability has not been patched. You should switch themes.

Healer – Doctor, Clinic & Medical WordPress Theme

Theme:
Healer – Doctor, Clinic & Medical WordPress Theme
Theme Slug:
healer
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28043
The vulnerability has not been patched. You should switch themes.

Helion

Theme:
Helion
Theme Slug:
helion
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28024
The vulnerability has not been patched. You should switch themes.

Helvig

Theme:
Helvig
Theme Slug:
helvig
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22436
The vulnerability has not been patched. You should switch themes.

Holmes

Theme:
Holmes
Theme Slug:
holmes
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22399
The vulnerability has not been patched. You should switch themes.

Honor

Theme:
Honor
Theme Slug:
honor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22419
The vulnerability has not been patched. You should switch themes.

Horizon

Theme:
Horizon
Theme Slug:
horizon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22420
The vulnerability has not been patched. You should switch themes.

Humanum

Theme:
Humanum
Theme Slug:
humanum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27985
The vulnerability has not been patched. You should switch themes.

Innovio

Theme:
Innovio
Theme Slug:
innovio
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22403
The vulnerability has not been patched. You should switch themes.

Invetex

Theme:
Invetex
Theme Slug:
invetex
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28031
The vulnerability has not been patched. You should switch themes.

Justicia

Theme:
Justicia
Theme Slug:
justicia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22408
The vulnerability has not been patched. You should switch themes.

Justitia

Theme:
Justitia
Theme Slug:
justitia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27995
The vulnerability has not been patched. You should switch themes.

Kayon

Theme:
Kayon
Theme Slug:
kayon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28027
The vulnerability has not been patched. You should switch themes.

Kingler

Theme:
Kingler
Theme Slug:
kingler
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27438
The vulnerability has not been patched. You should switch themes.

Kratz

Theme:
Kratz
Theme Slug:
kratz
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28013
The vulnerability has not been patched. You should switch themes.

Law Office

Theme:
Law Office
Theme Slug:
law-office
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28046
The vulnerability has not been patched. You should switch themes.

Legal Stone

Theme:
Legal Stone
Theme Slug:
legal-stone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28054
The vulnerability has not been patched. You should switch themes.

Legrand

Theme:
Legrand
Theme Slug:
legrand
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28066
The vulnerability has not been patched. You should switch themes.

Le Truffe

Theme:
Le Truffe
Theme Slug:
letruffe
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28069
The vulnerability has not been patched. You should switch themes.

Lingvico

Theme:
Lingvico
Theme Slug:
lingvico
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27996
The vulnerability has not been patched. You should switch themes.

Listify

Theme:
Listify
Theme Slug:
listify
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28042
The vulnerability has not been patched. You should switch themes.

Little Birdies

Theme:
Little Birdies
Theme Slug:
little-birdies
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28129
The vulnerability has not been patched. You should switch themes.

Luxury Wine

Theme:
Luxury Wine
Theme Slug:
luxury-wine
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28016
The vulnerability has not been patched. You should switch themes.

Mahogany

Theme:
Mahogany
Theme Slug:
mahogany
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28085
The vulnerability has not been patched. You should switch themes.

Malgré

Theme:
Malgré
Theme Slug:
malgre
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22413
The vulnerability has not been patched. You should switch themes.

Mandala

Theme:
Mandala
Theme Slug:
mandala
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28057
The vulnerability has not been patched. You should switch themes.

Manoir

Theme:
Manoir
Theme Slug:
manoir
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28019
The vulnerability has not been patched. You should switch themes.

Marcell

Theme:
Marcell
Theme Slug:
marcell
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28095
The vulnerability has not been patched. You should switch themes.

Marra

Theme:
Marra
Theme Slug:
marra
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22414
The vulnerability has not been patched. You should switch themes.

Maxify

Theme:
Maxify
Theme Slug:
maxify
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27997
The vulnerability has not been patched. You should switch themes.

MCKinney’s Politics

Theme:
MCKinney’s Politics
Theme Slug:
mckinney-politics
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28056
The vulnerability has not been patched. You should switch themes.

Meals & Wheels

Theme:
Meals & Wheels
Theme Slug:
meals-wheels
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27992
The vulnerability has not been patched. You should switch themes.

MediCenter – Health Medical Clinic

Theme:
MediCenter – Health Medical Clinic
Theme Slug:
medicenter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28137
The vulnerability has not been patched. You should switch themes.

Metro

Theme:
Metro
Theme Slug:
metro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27382
The vulnerability has not been patched. You should switch themes.

Metro

Theme:
Metro
Theme Slug:
metro
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27383
The vulnerability has not been patched. You should switch themes.

Midi

Theme:
Midi
Theme Slug:
midi
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28125
The vulnerability has not been patched. You should switch themes.

MoneyFlow

Theme:
MoneyFlow
Theme Slug:
moneyflow
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28028
The vulnerability has not been patched. You should switch themes.

Motorix

Theme:
Motorix
Theme Slug:
motorix
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28026
The vulnerability has not been patched. You should switch themes.

Musico

Theme:
Musico
Theme Slug:
musico
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27367
The vulnerability has not been patched. You should switch themes.

Muzicon

Theme:
Muzicon
Theme Slug:
muzicon
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28107
The vulnerability has not been patched. You should switch themes.

N7 | Golf Club Sports & Events

Theme:
N7 | Golf Club Sports & Events
Theme Slug:
n7-golf-club
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28045
The vulnerability has not been patched. You should switch themes.

Notarius

Theme:
Notarius
Theme Slug:
notarius
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28124
The vulnerability has not been patched. You should switch themes.

Nuts

Theme:
Nuts
Theme Slug:
nuts
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28023
The vulnerability has not been patched. You should switch themes.

Overton

Theme:
Overton
Theme Slug:
overton
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22405
The vulnerability has not been patched. You should switch themes.

Ozisti

Theme:
Ozisti
Theme Slug:
ozisti
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28093
The vulnerability has not been patched. You should switch themes.

Peter Mason

Theme:
Peter Mason
Theme Slug:
petermason
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28052
The vulnerability has not been patched. You should switch themes.

Photography

Theme:
Photography
Theme Slug:
photography
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27348
The vulnerability has not been patched. You should switch themes.

Pizza House

Theme:
Pizza House
Theme Slug:
pizzahouse
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-28074
The vulnerability has not been patched. You should switch themes.

Playa

Theme:
Playa
Theme Slug:
playa
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22437
The vulnerability has not been patched. You should switch themes.

Police Department

Theme:
Police Department
Theme Slug:
police-department
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28049
The vulnerability has not been patched. You should switch themes.

Porto

Theme:
Porto
Theme Slug:
porto
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28075
The vulnerability has not been patched. You should switch themes.

Printy

Theme:
Printy
Theme Slug:
printy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28035
The vulnerability has not been patched. You should switch themes.

Progress

Theme:
Progress
Theme Slug:
progress
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28034
The vulnerability has not been patched. You should switch themes.

Quantum

Theme:
Quantum
Theme Slug:
quantum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22421
The vulnerability has not been patched. You should switch themes.

Quanzo

Theme:
Quanzo
Theme Slug:
quanzo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27989
The vulnerability has not been patched. You should switch themes.

Ratatouille

Theme:
Ratatouille
Theme Slug:
ratatouille
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2026-28036
The vulnerability has not been patched. You should switch themes.

RexCoin

Theme:
RexCoin
Theme Slug:
rexcoin
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28094
The vulnerability has not been patched. You should switch themes.

Rhythmo

Theme:
Rhythmo
Theme Slug:
rhythmo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28068
The vulnerability has not been patched. You should switch themes.

Run Gran

Theme:
Run Gran
Theme Slug:
run-gran
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28086
The vulnerability has not been patched. You should switch themes.

Save Life

Theme:
Save Life
Theme Slug:
save-life
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28098
The vulnerability has not been patched. You should switch themes.

Scientia

Theme:
Scientia
Theme Slug:
scientia
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28010
The vulnerability has not been patched. You should switch themes.

SetSail

Theme:
SetSail
Theme Slug:
setsail
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22423
The vulnerability has not been patched. You should switch themes.

Shaha

Theme:
Shaha
Theme Slug:
shaha
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22424
The vulnerability has not been patched. You should switch themes.

ShiftCV

Theme:
ShiftCV
Theme Slug:
shift-cv
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28015
The vulnerability has not been patched. You should switch themes.

smart SEO

Theme:
smart SEO
Theme Slug:
smartSEO
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28117
The vulnerability has not been patched. You should switch themes.

Sounder

Theme:
Sounder
Theme Slug:
sounder
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28092
The vulnerability has not been patched. You should switch themes.

Stargaze

Theme:
Stargaze
Theme Slug:
stargaze
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28025
The vulnerability has not been patched. You should switch themes.

Starto

Theme:
Starto
Theme Slug:
starto
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27352
The vulnerability has not been patched. You should switch themes.

S.King

Theme:
S.King
Theme Slug:
stephanie-king
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28060
The vulnerability has not been patched. You should switch themes.

Sweet Jane

Theme:
Sweet Jane
Theme Slug:
sweetjane
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22425
The vulnerability has not been patched. You should switch themes.

Tediss

Theme:
Tediss
Theme Slug:
tediss
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27994
The vulnerability has not been patched. You should switch themes.

Tennis Club

Theme:
Tennis Club
Theme Slug:
tennis-sportclub
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2026-27437
The vulnerability has not been patched. You should switch themes.

The Mounty

Theme:
The Mounty
Theme Slug:
the-mounty
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22415
The vulnerability has not been patched. You should switch themes.

The Qlean

Theme:
The Qlean
Theme Slug:
the-qlean
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27987
The vulnerability has not been patched. You should switch themes.

Tiger Claw

Theme:
Tiger Claw
Theme Slug:
tiger-claw
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28061
The vulnerability has not been patched. You should switch themes.

Tooth Fairy

Theme:
Tooth Fairy
Theme Slug:
tooth-fairy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22428
The vulnerability has not been patched. You should switch themes.

TopFit – Fitness and Gym WordPress Theme

Theme:
TopFit – Fitness and Gym WordPress Theme
Theme Slug:
topfit
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27342
The vulnerability has not been patched. You should switch themes.

TopScorer – Sports WordPress Theme

Theme:
TopScorer – Sports WordPress Theme
Theme Slug:
topscorer
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27341
The vulnerability has not been patched. You should switch themes.

Translogic

Theme:
Translogic
Theme Slug:
translogic
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28014
The vulnerability has not been patched. You should switch themes.

Tribe

Theme:
Tribe
Theme Slug:
tribe
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22442
The vulnerability has not been patched. You should switch themes.

Tuning

Theme:
Tuning
Theme Slug:
tuning
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28032
The vulnerability has not been patched. You should switch themes.

UDesign

Theme:
UDesign
Theme Slug:
u-design
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28130
The vulnerability has not been patched. You should switch themes.

Vapester

Theme:
Vapester
Theme Slug:
vapester
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28077
The vulnerability has not been patched. You should switch themes.

Veil

Theme:
Veil
Theme Slug:
veil
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28123
The vulnerability has not been patched. You should switch themes.

Verdure

Theme:
Verdure
Theme Slug:
verdure
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22429
The vulnerability has not been patched. You should switch themes.

Verse

Theme:
Verse
Theme Slug:
verse
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28128
The vulnerability has not been patched. You should switch themes.

Victo

Theme:
Victo
Theme Slug:
victo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28047
The vulnerability has not been patched. You should switch themes.

Vixus

Theme:
Vixus
Theme Slug:
vixus
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-27998
The vulnerability has not been patched. You should switch themes.

Wabi-Sabi

Theme:
Wabi-Sabi
Theme Slug:
wabi-sabi
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22431
The vulnerability has not been patched. You should switch themes.

WealthCo

Theme:
WealthCo
Theme Slug:
wealthco
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28096
The vulnerability has not been patched. You should switch themes.

Welldone

Theme:
Welldone
Theme Slug:
welldone
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28118
The vulnerability has not been patched. You should switch themes.

M.Williamson

Theme:
M.Williamson
Theme Slug:
williamson
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28055
The vulnerability has not been patched. You should switch themes.

Windsor

Theme:
Windsor
Theme Slug:
windsor
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28081
The vulnerability has not been patched. You should switch themes.

Wolmart

Theme:
Wolmart
Theme Slug:
wolmart
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22385
The vulnerability has not been patched. You should switch themes.

Woopy

Theme:
Woopy
Theme Slug:
woopy
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22432
The vulnerability has not been patched. You should switch themes.

Yacht Rental

Theme:
Yacht Rental
Theme Slug:
yacht-rental
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28051
The vulnerability has not been patched. You should switch themes.

Yottis

Theme:
Yottis
Theme Slug:
yottis
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28011
The vulnerability has not been patched. You should switch themes.

Yungen

Theme:
Yungen
Theme Slug:
yungen
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-28006
The vulnerability has not been patched. You should switch themes.

Zentrum

Theme:
Zentrum
Theme Slug:
zentrum
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2026-22441
The vulnerability has not been patched. You should switch themes.

Blocksy

Theme:
Blocksy
Theme Slug:
blocksy
Downloads
6,306,227
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.31
Severity Score:
Medium
CVE:
2026-2583
The vulnerability has been patched, so you should update to version 2.1.31.

Automotive Car Dealership Business

Theme:
Automotive Car Dealership Business
Theme Slug:
automotive
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
13.4.2
Severity Score:
Medium
CVE:
2025-14040
The vulnerability has been patched, so you should update to version 13.4.2.

Listee

Theme:
Listee
Theme Slug:
listee
Vulnerability:
Privilege Escalation
Patched in Version:
1.1.7
Severity Score:
Critical
CVE:
2025-12981
The vulnerability has been patched, so you should update to version 1.1.7.

Molla

Theme:
Molla
Theme Slug:
molla
Vulnerability:
Local File Inclusion
Patched in Version:
1.5.17
Severity Score:
High
CVE:
2025-69339
The vulnerability has been patched, so you should update to version 1.5.17.

Sweet Date

Theme:
Sweet Date
Theme Slug:
sweetdate
Vulnerability:
PHP Object Injection
Patched in Version:
4.0.1
Severity Score:
Critical
CVE:
2026-27417
The vulnerability has been patched, so you should update to version 4.0.1.

The Issue

Theme:
The Issue
Theme Slug:
theissue
Vulnerability:
Local File Inclusion
Patched in Version:
1.6.12
Severity Score:
High
CVE:
2026-23801
The vulnerability has been patched, so you should update to version 1.6.12.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles