Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how thememove compares to other vendors in security performance

View Risk Score →

ThemeMove BrookWordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

Risk 70
Severity
7.5
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

First published (updated )
CVE-2026-57791

ThemeMove UnicampWordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability

Risk 51
Severity
7.5
EPSS
0.13%
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.7.1.

First published (updated )
CVE-2026-25027

wordpress/moodyWordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3.

First published (updated )
CVE-2025-22707

ThemeMove MitechWordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.

First published (updated )
CVE-2025-22708

ThemeMove Brook - Agency Business CreativeWordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

First published (updated )
CVE-2025-14430
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

ThemeMove AeroLandWordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through <= 1.6.6.

First published (updated )
CVE-2025-14429

wordpress/minimogwpWordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

First published (updated )
CVE-2025-60069

wordpress/minimogwp/minimogWordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

Risk 70
Severity
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

First published (updated )
CVE-2025-68062

ThemeMove EduMallWordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability

Risk 70
Severity
7.5
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.

First published (updated )
CVE-2025-68061

ThemeMove EduMallWordPress EduMall Theme < 4.4.5 - Local File Inclusion Vulnerability

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.

First published (updated )
CVE-2025-59564
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

ThemeMove BilleyWordPress Billey Theme < 2.1.6 - Local File Inclusion Vulnerability

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.

First published (updated )
CVE-2025-59558

ThemeMove Learts AddonsWordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability

Risk 61
Severity
9.3
SQL Injection
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.

First published (updated )
CVE-2025-59557

ThemeMove MedizinWordPress Medizin Theme < 1.9.7 - Local File Inclusion Vulnerability

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.

First published (updated )
CVE-2025-59555

ThemeMove BusinextWordPress Businext theme < 2.4.4 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP Local File Inclusion.This issue affects Businext: from n/a through < 2.4.4.

First published (updated )
CVE-2025-58967

ThemeMove SmilePureWordPress SmilePure Theme < 1.8.5 - Local File Inclusion Vulnerability

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/a through < 1.8.5.

First published (updated )
CVE-2025-58958
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

ThemeMove ThemeMove CoreWordPress ThemeMove Core Plugin <= 1.4.2 - PHP Object Injection Vulnerability

Risk 79
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core allows Object Injection. This issue affects ThemeMove Core: from n/a through 1.4.2.

1 / 2
Source: NVD

Remedy

No patched version available.
First published (updated )
CVE-2025-53303

ThemeMove MaxCoachWordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion Vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a through <= 3.2.5.

Remedy

Update the WordPress MaxCoach theme to the latest available version (at least 3.2.6).
First published (updated )
CVE-2025-58206

ThemeMove MakeaholicWordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.

Remedy

Update the WordPress Makeaholic theme to the latest available version (at least 1.8.7).
First published (updated )
CVE-2025-58210

ThemeMove UnicampWordPress Unicamp Theme <= 2.6.3 - Local File Inclusion Vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.6.3.

Remedy

Update the WordPress Unicamp theme to the latest available version (at least 2.6.4).
First published (updated )
CVE-2025-54701

ThemeMove MakeaholicWordPress Makeaholic Theme <= 1.8.4 - Local File Inclusion Vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic makeaholic allows PHP Local File Inclusion.This issue affects Makeaholic: from n/a through <= 1.8.4.

Remedy

Update the WordPress Makeaholic theme to the latest available version (at least 1.8.5).
First published (updated )
CVE-2025-54700
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

ThemeMove AmelyWordPress Amely theme <= 3.1.4 - SQL Injection vulnerability

Risk 86
Severity
9.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely amely allows SQL Injection.This issue affects Amely: from n/a through <= 3.1.4.

Remedy

Update the WordPress Amely theme to the latest available version (at least 3.2.0).
First published (updated )
CVE-2025-39474

ThemeMove HealsoulWordPress Healsoul theme <= 2.2.3 - Local File Inclusion Vulnerability

Risk 38
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul healsoul allows PHP Local File Inclusion.This issue affects Healsoul: from n/a through <= 2.2.3.

First published (updated )
CVE-2025-32309

ThemeMove Insight Core WordpressInsight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS

Risk 34
Severity
5.4
CSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insightcustomizeroptionsimport (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks

First published (updated )
CVE-2021-24950

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203