Skip to content
OpenAdvisories

Vendor

Select-Themes

39 known vulnerabilities.

Select-Themes at a glance

Last 12 months
33
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 7 vulnerabilities Dec 2025 January 2026: 3 vulnerabilities February 2026: 1 vulnerability March 2026: 6 vulnerabilities, 1 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 8 vulnerabilities Jun July 2026: 5 vulnerabilities August 2026: 2 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202611
Sep 202600
Aug 202620
Jul 202650
Jun 202680
May 202600
Apr 202600
Mar 202661
Feb 202610
Jan 202630
Dec 202570
Nov 202510
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202511
Feb 202500
Jan 202500
Dec 202400

Products

Stockholm 4 Stockholm Core 4 Struktur 3 Prowess 3 Tonda 2 Select Core 2 Don Peppe 2 SetSail 2 Tonda Core 2 Moments 1 WaveRide 1 Hiroshi 1 Mixtape 1 Getaway 1 Dessau 1 Mildhill 1 Struktur Core 1 Zermatt 1 Santé 1 SetSail Membership 1 Borgholm 1 Micdrop 1 Manufaktur Solutions 1 Tonda Membership 1
All Critical High Medium Low Exploited only Public exploit

39 results · Feed

  • Critical 9.8
    CVE-2026-62022

    WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

    Select-Themes Tonda Membership
  • High 8.1
    CVE-2026-28152

    WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

    Select-Themes Tonda Core
  • High 8.1
    CVE-2026-28151

    WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

    Select-Themes Tonda
  • High 7.5
    CVE-2026-65477

    WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

    Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

    Select-Themes Tonda Core
  • High 7.5
    CVE-2026-57801

    WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.

    Select-Themes SetSail
  • High 7.5
    CVE-2026-57802

    WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.

    Select-Themes Struktur
  • High 7.5
    CVE-2026-57803

    WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.

    Select-Themes Struktur Core
  • High 7.5
    CVE-2026-57805

    WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.

    Select-Themes Tonda
  • High 8.1
    CVE-2026-40752

    WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

    Select-Themes Manufaktur Solutions
  • High 8.1
    CVE-2026-39560

    WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

    Select-Themes Hiroshi
  • High 8.1
    CVE-2026-39573

    WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

    Select-Themes Mildhill
  • High 8.1
    CVE-2026-39545

    WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

    Select-Themes Zermatt
  • High 8.1
    CVE-2026-39580

    WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

    Select-Themes Micdrop
  • High 8.1
    CVE-2026-39567

    WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

    Select-Themes Santé
  • High 8.1
    CVE-2026-39547

    WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

    Select-Themes Getaway
  • High 8.1
    CVE-2026-39553

    WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

    Select-Themes WaveRide
  • Critical 9.8
    CVE-2026-32502

    WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

    Select-Themes Borgholm
  • High 8.1
    CVE-2026-25457

    WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows PHP Local File Inclusion.This issue affects Mixtape: from n/a through <= 2.1.

    Select-Themes Mixtape
  • High 8.1
    CVE-2026-25458

    WordPress Moments theme <= 2.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a through <= 2.2.

    Select-Themes Moments
  • High 8.1
    CVE-2026-22449

    WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allows PHP Local File Inclusion.This issue affects Don Peppe: from n/a through <= 1.3.

    Select-Themes Don Peppe
  • High 8.1
    CVE-2026-22446

    WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 1.8.1.

    Select-Themes Prowess
  • High 8.1
    CVE-2026-22423

    WordPress SetSail theme <= 1.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 1.8.

    Select-Themes SetSail
  • High 8.1
    CVE-2025-69407

    WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows PHP Local File Inclusion.This issue affects Struktur: from n/a through <= 2.5.1.

    Select-Themes Struktur
  • High 7.5
    CVE-2026-24531

    WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 2.3.

    Select-Themes Prowess
  • Medium 4.3
    CVE-2026-22450

    WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.

    Select-Themes Don Peppe
  • Medium 4.3
    CVE-2026-22447

    WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prowess: from n/a through <= 1.8.1.

    Select-Themes Prowess
  • Medium 5.4
    CVE-2025-69029

    WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1.

    Select-Themes Struktur
  • Medium 6.5
    CVE-2025-68076

    WordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through <= 2.4.6.

    Select-Themes Stockholm Core
  • Medium 6.5
    CVE-2025-68077

    WordPress Stockholm theme <= 9.14.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm stockholm allows Stored XSS.This issue affects Stockholm: from n/a through <= 9.14.1.

    Select-Themes Stockholm
  • High 7.5
    CVE-2025-68068

    WordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through <= 9.14.1.

    Select-Themes Stockholm
  • High 7.5
    CVE-2025-68067

    WordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm-core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through <= 2.4.6.

    Select-Themes Stockholm Core
  • Medium 6.5
    CVE-2025-67539

    WordPress Select Core plugin < 2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS.This issue affects Select Core: from n/a through < 2.6.

    Select-Themes Select Core
  • High 7.5
    CVE-2025-67521

    WordPress Select Core plugin < 2.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Select Core select-core allows PHP Local File Inclusion.This issue affects Select Core: from n/a through < 2.6.

    Select-Themes Select Core
  • High 7.5
    CVE-2025-39463

    WordPress Dessau theme < 1.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Dessau dessau allows PHP Local File Inclusion.This issue affects Dessau: from n/a through < 1.9.

    Select-Themes Dessau
  • Critical 9.8
    CVE-2025-1564

    SetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover

    The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log i…

    Select-Themes SetSail Membership Web / CMS
  • High 8.5
    CVE-2024-34554

    WordPress Stockholm Core plugin <= 2.4.1 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through 2.4.1.

    Select-Themes Stockholm Core
  • High 8.5
    CVE-2024-34552

    WordPress Stockholm theme <= 9.6 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.

    Select-Themes Stockholm
  • Critical 9.0
    CVE-2024-34551

    WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.

    Select-Themes Stockholm
  • High 7.1
    CVE-2024-34553

    WordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This issue affects Stockholm Core: from n/a through 2.4.1.

    Select-Themes Stockholm Core