Edge-Themes vulnerabilities

Products

• Aalto 2
• Alloggio - Hotel Booking 2
• Edge CPT 2
• Eldon 2
• Overworld 2
• Alloggio Membership 1
• Archicon 1
• Barista 1
• Behold 1
• Belletrist 1
• Cinerama 1
• Gracey 1
• Haaken 1
• Kamperen 1
• Laurits 1
• Pelicula 1
• Reina 1
• UrbanGo Membership 1
• Valeska 1

Latest Edge-Themes CVEs

Newest publication first

1. CVE-2026-42777 WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

   Published 2026-10-10

   High·CVSS 8.1 EPSS 0.34%

   Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

2. CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

   Published 2026-10-06

   High·CVSS 8.1 EPSS 0.25%

   Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

3. CVE-2026-66653 WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

   Published 2026-08-13

   High·CVSS 8.1 EPSS 0.47%

   Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

4. CVE-2026-57788 WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

   Published 2026-07-13

   High·CVSS 7.5 EPSS 0.51%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.

5. CVE-2026-57800 WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability

   Published 2026-07-13

   High·CVSS 7.5 EPSS 0.51%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.

6. CVE-2026-40738 WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability

   Published 2026-06-17

   High·CVSS 8.1 EPSS 0.31%

   Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

7. CVE-2026-40735 WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

   Published 2026-06-17

   High·CVSS 8.1 EPSS 0.40%

   Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

8. CVE-2026-40761 WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

   Published 2026-06-16

   High·CVSS 8.1 EPSS 0.25%

   Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

9. CVE-2026-40760 WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

   Published 2026-06-16

   High·CVSS 8.1 EPSS 0.25%

   Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

10. CVE-2026-40736 WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability

    Published 2026-06-16

    High·CVSS 8.1 EPSS 0.25%

    Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

11. CVE-2026-39539 WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability

    Published 2026-06-16

    High·CVSS 8.1 EPSS 0.31%

    Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

12. CVE-2026-32512 WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability

    Published 2026-03-25

    Critical·CVSS 9.8 EPSS 0.40%

    Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

13. CVE-2026-32509 WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability

    Published 2026-03-25

    Medium·CVSS 5.4 EPSS 0.18%

    Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.

14. CVE-2026-32510 WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability

    Published 2026-03-25

    Medium·CVSS 5.4 EPSS 0.18%

    Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.

15. CVE-2026-32506 WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability

    Published 2026-03-25

    Medium·CVSS 5.4 EPSS 0.18%

    Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.

16. CVE-2025-69410 WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability

    Published 2026-02-20

    High·CVSS 8.1 EPSS 0.58%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Belletrist belletrist allows PHP Local File Inclusion.This issue affects Belletrist: from n/a through <= 1.2.

17. CVE-2025-69057 WordPress Eldon theme <= 1.0 - Local File Inclusion vulnerability

    Published 2026-01-22

    High·CVSS 8.1 EPSS 0.57%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Eldon eldon allows PHP Local File Inclusion.This issue affects Eldon: from n/a through <= 1.0.

18. CVE-2025-69050 WordPress Overworld theme <= 1.3 - Local File Inclusion vulnerability

    Published 2026-01-22

    High·CVSS 8.1 EPSS 0.48%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.3.

19. CVE-2025-68987 WordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerability

    Published 2025-12-30

    High·CVSS 7.5 EPSS 0.46%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a through <= 2.9.

20. CVE-2025-64287 WordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerability

    Published 2025-11-06

    High·CVSS 8.1 EPSS 0.43%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8.

21. CVE-2025-62868 WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability

    Published 2025-10-24

    High·CVSS 8.1 EPSS 0.47%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4.

22. CVE-2025-49889 WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability

    Published 2025-08-20

    High·CVSS 8.1 EPSS 0.73%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT edge-cpt allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through <= 1.4.

23. CVE-2025-3278 UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation

    Published 2025-04-19

    Critical·CVSS 9.8 EPSS 0.58%

    The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_register_role' field. This makes it pos...

24. CVE-2025-1638 Alloggio Membership <= 1.1 - Authentication Bypass via Social Login Account Takeover

    Published 2025-03-01

    Critical·CVSS 9.8 EPSS 0.64%

    The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membershi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.