# cve.now: Edge-themes

The newest entries naming Edge-themes as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-42777](https://cve.now/CVE-2026-42777.md): WordPress Aalto theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-104747](https://cve.now/CVE-2026-104747.md): WordPress Haaken theme \<= 1.5 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2025-15637](https://cve.now/CVE-2025-15637.md): WordPress Shuffle theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-66653](https://cve.now/CVE-2026-66653.md): WordPress Barista theme \<= 2.5.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-57800](https://cve.now/CVE-2026-57800.md): WordPress Overworld theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57788](https://cve.now/CVE-2026-57788.md): WordPress Aalto theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-40738](https://cve.now/CVE-2026-40738.md): WordPress Eldon theme \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40735](https://cve.now/CVE-2026-40735.md): WordPress Reina theme \<= 2.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40761](https://cve.now/CVE-2026-40761.md): WordPress Valeska theme \<= 1.2.2 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40760](https://cve.now/CVE-2026-40760.md): WordPress Behold theme \<= 1.5 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40736](https://cve.now/CVE-2026-40736.md): WordPress Laurits theme \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39539](https://cve.now/CVE-2026-39539.md): WordPress Alloggio - Hotel Booking theme \<= 2.1.2 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-32512](https://cve.now/CVE-2026-32512.md): WordPress Pelicula theme \< 1.10 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-32510](https://cve.now/CVE-2026-32510.md): WordPress Kamperen theme \< 1.3 - Arbitrary Object Instantiation vulnerability (CVSS 5.4)
- [CVE-2026-32509](https://cve.now/CVE-2026-32509.md): WordPress Gracey theme \< 1.4 - Arbitrary Object Instantiation vulnerability (CVSS 5.4)
- [CVE-2026-32506](https://cve.now/CVE-2026-32506.md): WordPress Archicon theme \< 1.7 - Arbitrary Object Instantiation vulnerability (CVSS 5.4)
- [CVE-2025-69410](https://cve.now/CVE-2025-69410.md): WordPress Belletrist theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-69057](https://cve.now/CVE-2025-69057.md): WordPress Eldon theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-69050](https://cve.now/CVE-2025-69050.md): WordPress Overworld theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68987](https://cve.now/CVE-2025-68987.md): WordPress Cinerama theme \<= 2.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64287](https://cve.now/CVE-2025-64287.md): WordPress Alloggio - Hotel Booking Theme theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-62868](https://cve.now/CVE-2025-62868.md): WordPress Edge CPT plugin \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-49889](https://cve.now/CVE-2025-49889.md): WordPress Edge CPT plugin \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-3278](https://cve.now/CVE-2025-3278.md): UrbanGo Membership \<= 1.0.4 - Unauthenticated Privilege Escalation (CVSS 9.8)
- [CVE-2025-1638](https://cve.now/CVE-2025-1638.md): Alloggio Membership \<= 1.1 - Authentication Bypass via Social Login Account Takeover (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/edge-themes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.