# cve.now: Mikado-themes

The newest entries naming Mikado-themes as an affected vendor (up to 200), of 88 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-62020](https://cve.now/CVE-2026-62020.md): WordPress TouchUp theme \< 1.4 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-66657](https://cve.now/CVE-2026-66657.md): WordPress Biagiotti Core plugin \<= 2.1.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-66656](https://cve.now/CVE-2026-66656.md): WordPress Foton Core plugin \<= 1.1.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-57792](https://cve.now/CVE-2026-57792.md): WordPress Dør theme \<= 2.4.1 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-52707](https://cve.now/CVE-2026-52707.md): WordPress Kastell theme \<= 2.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-40757](https://cve.now/CVE-2026-40757.md): WordPress Château theme \<= 1.2.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40756](https://cve.now/CVE-2026-40756.md): WordPress Zoya theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40733](https://cve.now/CVE-2026-40733.md): WordPress ShiftUp theme \<= 1.3 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40753](https://cve.now/CVE-2026-40753.md): WordPress EasyMeals theme \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40731](https://cve.now/CVE-2026-40731.md): WordPress ChapterOne theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-39537](https://cve.now/CVE-2026-39537.md): WordPress Mikado Core plugin \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-40759](https://cve.now/CVE-2026-40759.md): WordPress Esmée theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40755](https://cve.now/CVE-2026-40755.md): WordPress TechLink theme \<= 1.3 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40751](https://cve.now/CVE-2026-40751.md): WordPress Ashtanga theme \<= 1.2 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-40739](https://cve.now/CVE-2026-40739.md): WordPress LuxeDrive theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39538](https://cve.now/CVE-2026-39538.md): WordPress Mikado Core plugin \<= 1.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-32511](https://cve.now/CVE-2026-32511.md): WordPress Stål theme \< 1.7 - Arbitrary Object Instantiation vulnerability (CVSS 5.4)
- [CVE-2026-32508](https://cve.now/CVE-2026-32508.md): WordPress Halstein theme \< 1.8 - Arbitrary Object Instantiation vulnerability (CVSS 5.4)
- [CVE-2026-27081](https://cve.now/CVE-2026-27081.md): WordPress Rosebud theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27080](https://cve.now/CVE-2026-27080.md): WordPress Deston theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27079](https://cve.now/CVE-2026-27079.md): WordPress Amfissa theme \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27078](https://cve.now/CVE-2026-27078.md): WordPress Emaurri theme \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27077](https://cve.now/CVE-2026-27077.md): WordPress MultiOffice theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27076](https://cve.now/CVE-2026-27076.md): WordPress LuxeDrive theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27075](https://cve.now/CVE-2026-27075.md): WordPress Belfort theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27047](https://cve.now/CVE-2026-27047.md): WordPress Curly Core plugin \<= 2.1.6 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27342](https://cve.now/CVE-2026-27342.md): WordPress TopFit - Fitness and Gym WordPress Theme theme \<= 1.9 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-27341](https://cve.now/CVE-2026-27341.md): WordPress TopScorer - Sports WordPress Theme theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22457](https://cve.now/CVE-2026-22457.md): WordPress Wanderland theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22429](https://cve.now/CVE-2026-22429.md): WordPress Verdure theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22427](https://cve.now/CVE-2026-22427.md): WordPress GoTravel theme \<= 2.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22414](https://cve.now/CVE-2026-22414.md): WordPress Marra theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22413](https://cve.now/CVE-2026-22413.md): WordPress Malgré theme \<= 1.0.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22412](https://cve.now/CVE-2026-22412.md): WordPress Eona theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22410](https://cve.now/CVE-2026-22410.md): WordPress Dolcino theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22408](https://cve.now/CVE-2026-22408.md): WordPress Justicia theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22405](https://cve.now/CVE-2026-22405.md): WordPress Overton theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22403](https://cve.now/CVE-2026-22403.md): WordPress Innovio theme \<= 1.9 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22399](https://cve.now/CVE-2026-22399.md): WordPress Holmes theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22397](https://cve.now/CVE-2026-22397.md): WordPress Fleur theme \<= 2.2.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22395](https://cve.now/CVE-2026-22395.md): WordPress Fiorello theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22394](https://cve.now/CVE-2026-22394.md): WordPress Evently theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22392](https://cve.now/CVE-2026-22392.md): WordPress Cortex theme \<= 1.9 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22389](https://cve.now/CVE-2026-22389.md): WordPress Cocco theme \<= 2.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22387](https://cve.now/CVE-2026-22387.md): WordPress Aviana theme \<= 2.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22383](https://cve.now/CVE-2026-22383.md): WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme \<= 1.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5)
- [CVE-2026-22381](https://cve.now/CVE-2026-22381.md): WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22344](https://cve.now/CVE-2026-22344.md): WordPress FiveStar theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-69408](https://cve.now/CVE-2025-69408.md): WordPress HealthFirst theme \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-24631](https://cve.now/CVE-2026-24631.md): WordPress Rosebud theme \<= 1.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22458](https://cve.now/CVE-2026-22458.md): WordPress Wanderland theme \<= 1.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-22430](https://cve.now/CVE-2026-22430.md): WordPress Verdure theme \<= 1.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22411](https://cve.now/CVE-2026-22411.md): WordPress Dolcino theme \<= 1.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22409](https://cve.now/CVE-2026-22409.md): WordPress Justicia theme \<= 1.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22407](https://cve.now/CVE-2026-22407.md): WordPress Roam theme \<= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22406](https://cve.now/CVE-2026-22406.md): WordPress Overton theme \<= 1.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22404](https://cve.now/CVE-2026-22404.md): WordPress Innovio theme \<= 1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22400](https://cve.now/CVE-2026-22400.md): WordPress Holmes theme \<= 1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22398](https://cve.now/CVE-2026-22398.md): WordPress Fleur theme \<= 2.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22396](https://cve.now/CVE-2026-22396.md): WordPress Fiorello theme \<= 1.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22393](https://cve.now/CVE-2026-22393.md): WordPress Curly theme \<= 3.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22391](https://cve.now/CVE-2026-22391.md): WordPress Cocco theme \<= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-22382](https://cve.now/CVE-2026-22382.md): WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme \<= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-67940](https://cve.now/CVE-2025-67940.md): WordPress Powerlift theme \< 3.2.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67938](https://cve.now/CVE-2025-67938.md): WordPress Biagiotti theme \< 3.5.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-54003](https://cve.now/CVE-2025-54003.md): WordPress Depot theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67937](https://cve.now/CVE-2025-67937.md): WordPress Hendon theme \< 1.7 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67936](https://cve.now/CVE-2025-67936.md): WordPress Curly theme \< 3.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67935](https://cve.now/CVE-2025-67935.md): WordPress Optimize theme \< 2.4 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67934](https://cve.now/CVE-2025-67934.md): WordPress Wellspring theme \< 2.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-69034](https://cve.now/CVE-2025-69034.md): WordPress Lekker theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-69032](https://cve.now/CVE-2025-69032.md): WordPress FiveStar theme \<= 1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2025-69030](https://cve.now/CVE-2025-69030.md): WordPress Backpack Traveler theme \<= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2025-67515](https://cve.now/CVE-2025-67515.md): WordPress Wilmër theme \< 3.5 - Local File Inclusion vulnerability (CVSS 8.8)
- [CVE-2025-66532](https://cve.now/CVE-2025-66532.md): WordPress Powerlift theme \< 3.2.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-39467](https://cve.now/CVE-2025-39467.md): WordPress Wanderland theme \<= 1.7.1 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-39466](https://cve.now/CVE-2025-39466.md): WordPress Dør theme \<= 2.4 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-64368](https://cve.now/CVE-2025-64368.md): WordPress Bard theme \<= 1.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-9058](https://cve.now/CVE-2025-9058.md): Mikado Core \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-9061](https://cve.now/CVE-2025-9061.md): Wilmer Core \<= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-9057](https://cve.now/CVE-2025-9057.md): Biagiotti Core \<= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-49295](https://cve.now/CVE-2025-49295.md): WordPress MediClinic theme \<= 2.1 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49296](https://cve.now/CVE-2025-49296.md): WordPress GrandPrix theme \<= 1.6 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49297](https://cve.now/CVE-2025-49297.md): WordPress Grill and Chow theme \<= 1.6 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-39490](https://cve.now/CVE-2025-39490.md): WordPress Backpack Traveler theme \<= 2.10.2 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-39494](https://cve.now/CVE-2025-39494.md): WordPress Wilmër theme \< 3.4.2 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-39458](https://cve.now/CVE-2025-39458.md): WordPress Foton theme \<= 2.5.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2024-12287](https://cve.now/CVE-2024-12287.md): Biagiotti Membership \<= 1.0.2 - Authentication Bypass via biagiotti\_membership\_check\_facebook\_user (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mikado-themes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.