Skip to content
OpenAdvisories

Vendor

Mikado-Themes

88 known vulnerabilities.

Products

Wanderland 3 PawFriends - Pet Shop and Veterinary WordPress Theme 3 Mikado Core 3 Cocco 2 Overton 2 Biagiotti Core 2 Verdure 2 Wilmër 2 Innovio 2 Fleur 2 Justicia 2 Holmes 2 FiveStar 2 Powerlift 2 Curly 2 Fiorello 2 LuxeDrive 2 Backpack Traveler 2 Rosebud 2 Dør 2 Dolcino 2 ChapterOne 1 MediClinic 1 TouchUp 1 Château 1 Stål 1 Kastell 1 GoTravel 1 Foton Core 1 TechLink 1 MultiOffice 1 Optimize 1 EasyMeals 1 Biagiotti 1 Eona 1 Belfort 1 Emaurri 1 Esmée 1 Wellspring 1 Curly Core 1
All Critical High Medium Low Exploited only Public exploit

23 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-32511

    WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability

    Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7.

    Mikado-Themes Stål
  • Medium 5.4
    CVE-2026-32508

    WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability

    Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through < 1.8.

    Mikado-Themes Halstein
  • Medium 5.4
    CVE-2026-24631

    WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.

    Mikado-Themes Rosebud
  • Medium 4.3
    CVE-2026-22458

    WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wanderland: from n/a through <= 1.5.

    Mikado-Themes Wanderland
  • Medium 5.4
    CVE-2026-22411

    WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.

    Mikado-Themes Dolcino
  • Medium 5.4
    CVE-2026-22409

    WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.

    Mikado-Themes Justicia
  • Medium 5.4
    CVE-2026-22430

    WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.

    Mikado-Themes Verdure
  • Medium 5.4
    CVE-2026-22407

    WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.

    Mikado-Themes Roam
  • Medium 5.4
    CVE-2026-22404

    WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.

    Mikado-Themes Innovio
  • Medium 5.4
    CVE-2026-22406

    WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.

    Mikado-Themes Overton
  • Medium 5.4
    CVE-2026-22396

    WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.

    Mikado-Themes Fiorello
  • Medium 5.4
    CVE-2026-22393

    WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.

    Mikado-Themes Curly
  • Medium 5.4
    CVE-2026-22400

    WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.

    Mikado-Themes Holmes
  • Medium 5.4
    CVE-2026-22398

    WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.

    Mikado-Themes Fleur
  • Medium 5.4
    CVE-2026-22391

    WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through <= 1.5.1.

    Mikado-Themes Cocco
  • Medium 5.4
    CVE-2026-22382

    WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.

    Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme Web / CMS
  • Medium 5.4
    CVE-2025-69032

    WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.

    Mikado-Themes FiveStar
  • Medium 5.4
    CVE-2025-69030

    WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.

    Mikado-Themes Backpack Traveler
  • Medium 4.3
    CVE-2025-66532

    WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Powerlift: from n/a through < 3.2.1.

    Mikado-Themes Powerlift
  • Medium 5.4
    CVE-2025-64368

    WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 1.6.

    Mikado-Themes Bard
  • Medium 6.4
    CVE-2025-9058

    Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent…

    Mikado-Themes Mikado Core Web / CMS
  • Medium 6.4
    CVE-2025-9061

    Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent…

    Mikado-Themes Wilmer Core Web / CMS
  • Medium 6.4
    CVE-2025-9057

    Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth…

    Mikado-Themes Biagiotti Core Web / CMS