ThemeBing vulnerabilities and threats

CVE-2026-32471 is a high severity SQL Injection vulnerability affecting ProLancer Element versions up to and including 1.4.8. The flaw involves improper neutralization of special elements in SQL commands, specifically in the Subscriber component. This vulnerability allows an attacker with low privileges and no user interaction to cause a partial denial of service and potentially impact data confidentiality. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-28190 is a high severity vulnerability in ThemeBing's ProLancer Element plugin versions up to and including 1.4.8. It involves broken access control, specifically a missing authorization check (CWE-862), which can lead to unauthorized actions by users with limited privileges. The vulnerability does not impact confidentiality but can cause high integrity impact and low availability impact. No official patch or remediation guidance is currently available from the vendor.