# cve.now: Pencidesign

The newest entries naming Pencidesign as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93902](https://cve.now/CVE-2026-93902.md): Soledad \<= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields (CVSS 6.4)
- [CVE-2026-27054](https://cve.now/CVE-2026-27054.md): WordPress Penci Soledad Data Migrator plugin \<= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27069](https://cve.now/CVE-2026-27069.md): WordPress Soledad theme \<= 8.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-27059](https://cve.now/CVE-2026-27059.md): WordPress Penci Recipe plugin \<= 4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-27058](https://cve.now/CVE-2026-27058.md): WordPress Penci Podcast plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-27057](https://cve.now/CVE-2026-27057.md): WordPress Penci Filter Everything plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-27055](https://cve.now/CVE-2026-27055.md): WordPress Penci AI SmartContent Creator plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-24601](https://cve.now/CVE-2026-24601.md): WordPress Penci Pay Writer plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-24600](https://cve.now/CVE-2026-24600.md): WordPress Penci Review plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-24354](https://cve.now/CVE-2026-24354.md): WordPress Penci Shortcodes & Performance plugin \<= 6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64223](https://cve.now/CVE-2025-64223.md): WordPress PenNews theme \< 6.7.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-64188](https://cve.now/CVE-2025-64188.md): WordPress Soledad theme \<= 8.6.9 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2025-68066](https://cve.now/CVE-2025-68066.md): WordPress Soledad theme \<= 8.7.0 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-67572](https://cve.now/CVE-2025-67572.md): WordPress PenNews theme \< 6.7.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-49909](https://cve.now/CVE-2025-49909.md): WordPress Penci Bookmark & Follow plugin \< 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-59583](https://cve.now/CVE-2025-59583.md): WordPress Penci Filter Everything Plugin \< 1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-59584](https://cve.now/CVE-2025-59584.md): WordPress Penci Podcast Plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-59585](https://cve.now/CVE-2025-59585.md): WordPress Penci Recipe Plugin \<= 4.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-59586](https://cve.now/CVE-2025-59586.md): WordPress Penci Portfolio Plugin \<= 3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-59587](https://cve.now/CVE-2025-59587.md): WordPress Penci Shortcodes & Performance Plugin \< 6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-59588](https://cve.now/CVE-2025-59588.md): WordPress Soledad Theme \<= 8.6.8 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-59589](https://cve.now/CVE-2025-59589.md): WordPress Soledad Theme \<= 8.6.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-8143](https://cve.now/CVE-2025-8143.md): Soledad \<= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml\_smartlists\_h' (CVSS 6.4)
- [CVE-2025-8105](https://cve.now/CVE-2025-8105.md): Soledad \<= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2025-8142](https://cve.now/CVE-2025-8142.md): Soledad \<= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header\_layout' (CVSS 8.8)
- [CVE-2024-11289](https://cve.now/CVE-2024-11289.md): Soledad \<= 8.5.9 - Unauthenticated Limited Local File Inclusion (CVSS 8.1)
- [CVE-2024-3551](https://cve.now/CVE-2024-3551.md): Penci Soledad Data Migrator \<= 1.3.0 - Unauthenticated Local File Inclusion (CVSS 9.8)
- [CVE-2024-31369](https://cve.now/CVE-2024-31369.md): WordPress Soledad theme \<= 8.4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-31368](https://cve.now/CVE-2024-31368.md): WordPress Soledad theme \<= 8.4.2 - Unauthenticated Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-31367](https://cve.now/CVE-2024-31367.md): WordPress Soledad theme \<= 8.4.2 - Authenticated Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2023-49826](https://cve.now/CVE-2023-49826.md): WordPress Soledad Theme \<= 8.4.1 is vulnerable to PHP Object Injection (CVSS 8.1)
- [CVE-2023-49825](https://cve.now/CVE-2023-49825.md): WordPress Soledad Theme \<= 8.4.1 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-49827](https://cve.now/CVE-2023-49827.md): WordPress Soledad Theme \<= 8.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-41788](https://cve.now/CVE-2022-41788.md): WordPress Soledad premium theme \<= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pencidesign
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.