Elated Themes vulnerabilities and threats

CVE-2026-112820 is a high-severity vulnerability in Elated-Themes Academist Core (versions up to 1.4.1) involving improper control of filenames in include/require statements, leading to PHP Local File Inclusion. This flaw allows an attacker to include local files on the server, potentially resulting in full compromise of confidentiality, integrity, and availability.

CVE-2026-66566 is a high-severity vulnerability in Elated-Themes Ambient versions up to 1.7. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

The Mane theme for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 1.7. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to remote code execution, bypass of access controls, and exposure of sensitive data.

CVE-2026-66670 is a high severity vulnerability affecting Elated-Themes Måne versions up to and including 1.7. It involves an unauthenticated local file inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-66671 is a high-severity vulnerability in Elated-Themes Verdure Core versions up to and including 1.2. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information.

Contributor Local File Inclusion in Vino <= 1.9 versions.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.

Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

CVE-2026-39576 is a high-severity vulnerability in Elated-Themes SingleMalt versions up to and including 1.5. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-39556 is a high severity vulnerability affecting Elated-Themes Konsept versions up to and including 1.9. It involves unauthenticated PHP object injection, categorized under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-39523 is a high-severity vulnerability in Elated-Themes Solene Core versions up to and including 2.3.2. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to potentially include and execute arbitrary local files on the affected system without authentication.

CVE-2026-39558 is a high severity vulnerability in Elated-Themes Malmö versions up to and including 2.2. It is an unauthenticated local file inclusion (LFI) issue caused by improper control of filenames used in include or require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.