These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross-site Scripting (XSS) vulnerability exists in the Kids Planet theme, affecting versions from n/a through 2.2.14.2. This issue allows for Reflected XSS attacks. The vulnerability can be exploited by injecting malicious scripts, potentially impacting user sessions, data integrity, and web application security. Defenders should verify exposure, prioritize patching or mitigation efforts, and monitor fo [truncated]
A critical vulnerability was found in the WordPress Camelia theme, versions up to and including 1.2.15. This issue allows for PHP Object Injection due to the deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Defenders should assess exposure and prioritize remediation efforts. The vulnerability could lead to potential code execution and data bre [truncated]
A critical vulnerability was found in the WordPress Convex theme, affecting versions up to 1.16.0. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8 and is considered critical. Defenders and administrators of WordPress systems using the Convex theme should be aware of this vulnerability and take necessary actions to mitigate it. [truncated]
The CVE-2026-93942 vulnerability is a critical PHP Object Injection issue in the WordPress Dwell theme, affecting versions up to 1.16.0. This Deserialization of Untrusted Data vulnerability has a CVSS score of 9.8. Defenders should assess exposure, prioritize remediation, and verify inventory for affected systems. The CVE record and source item provide details on the vulnerability, but limited information [truncated]
The CVE-2026-93941 vulnerability is a PHP Object Injection issue in the WordPress Edema theme, affecting versions up to 1.2.2.2. This critical vulnerability has a CVSS score of 9.8 and is categorized as a Deserialization of Untrusted Data vulnerability. The issue arises from the deserialization of untrusted data, which allows for object injection. The affected product is the Edema theme by ThemeREX Group.
A critical vulnerability was found in the WordPress Greeny theme, versions up to and including 2.10.0. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Defenders should assess exposure and prioritize patching or mitigation. The vulnerability could lead to significant impact if exploited, includ [truncated]
A critical vulnerability was found in the WordPress Hogwords theme, versions up to and including 1.2.7. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Defenders should assess exposure, prioritize remediation, and verify the effectiveness of compensating controls.
A critical vulnerability was found in the WordPress Hygia theme, versions up to and including 1.21.0, which allows for PHP Object Injection due to deserialization of untrusted data. This issue, tracked as CVE-2026-93937, has a CVSS score of 9.8, indicating a high severity level. The vulnerability is exploitable over the network with low attack complexity and requires no user interaction or privileges.
A critical vulnerability was found in the WordPress IPharm theme, versions up to and including 1.2.4. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Defenders should assess exposure and prioritize mitigation, including patching or updating the theme, implementing measures to prevent deseriali [truncated]
A critical vulnerability was found in the WordPress Let's Play theme, affecting versions up to 1.1.15. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8 and is considered critical. Defenders responsible for WordPress installations, particularly those using the Let's Play theme, should assess their exposure and take necessary acti [truncated]
The CVE-2026-93934 vulnerability is a PHP Object Injection issue in the Partiso WordPress theme, affecting versions up to 1.1.13. This critical vulnerability has a CVSS score of 9.8 and is caused by deserialization of untrusted data. Defenders should assess exposure, prioritize remediation, and verify inventory for Partiso theme usage. The vulnerability's high severity indicates potential for significant [truncated]
A critical vulnerability was found in the Rosalinda WordPress theme, affecting versions up to 1.2.4. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating high severity. Defenders should assess exposure, prioritize remediation, and monitor for potential exploitation attempts. The CVE record and source item provide details [truncated]
A critical vulnerability was found in the WordPress Smart Casa theme, versions up to and including 1.0.12. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Defenders should assess exposure of WordPress installations using the Smart Casa theme, versions up to and including 1.0.12, and apply patc [truncated]
A critical vulnerability was found in the WordPress Smash theme, versions up to 1.12.0, which allows for PHP Object Injection due to deserialization of untrusted data. This issue, tracked as CVE-2026-93931, has a CVSS score of 9.8, indicating a high severity level. The vulnerability is exploitable via network, requires no authentication or user interaction, and can lead to high impacts on confidentiality, [truncated]
A critical vulnerability was found in the WordPress Tantra theme, versions up to and including 2.9.0, which allows for PHP Object Injection due to deserialization of untrusted data. This issue, tracked as CVE-2026-93930, has a CVSS score of 9.8, indicating a high severity level. The vulnerability is exploitable over the network with low attack complexity, requiring no privileges or user interaction. Succe [truncated]
A critical vulnerability was found in the WordPress Travesia theme, versions up to and including 1.1.16. This issue allows for PHP Object Injection due to the deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. The vulnerability affects the Travesia theme, a component used in WordPress installations, and could potentially lead to high impacts on [truncated]
A critical vulnerability was found in the WordPress Gutentype theme, versions up to and including 2.1.12. This issue allows for PHP Object Injection due to the deserialization of untrusted data. The vulnerability has a CVSS score of 9.8, indicating a high severity level. The vulnerability is considered critical and could potentially lead to significant impact if exploited, including potential code executi [truncated]
The CVE-2026-62045 vulnerability is a PHP Object Injection issue in the WordPress Booklovers theme, version 2.13.0 and earlier. This vulnerability is a result of deserialization of untrusted data, allowing for potential object injection. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Defenders should be aware of this vulnerability and take necessary actions to mitigate [truncated]
CVE-2026-39529 is a critical vulnerability in the Elementra theme, affecting versions up to 1.0.9. This vulnerability allows for unauthenticated PHP object injection, posing a significant risk to affected systems. With a CVSS score of 9.8, it is considered critical. The vulnerability was published on June 17, 2026, and last modified on the same day. Users of the Elementra theme should take immediate actio [truncated]
CVE-2025-60085 is an Unauthenticated Local File Inclusion vulnerability in Learnify versions <= 1.15.0. The vulnerability has a CVSS score of 8.1 and is classified as HIGH severity. The CVE record was published on 2026-06-17T13:19:15.317Z and was last modified on 2026-06-17T14:45:15.717Z. This vulnerability allows unauthenticated attackers to include local files, potentially leading to data breaches or sy [truncated]
CVE-2025-58924 is an Unauthenticated Local File Inclusion vulnerability in Geya <= 1.15 versions. The CVE record was published on 2026-06-17T13:19:14.387Z and has not been modified since then. The NVD entry is currently Deferred. This vulnerability allows an unauthenticated attacker to include local files, potentially leading to code execution. Users of Geya theme version 1.15 or earlier should be aware o [truncated]
