# cve.now: Select-themes

The newest entries naming Select-themes as an affected vendor (up to 200), of 39 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-62022](https://cve.now/CVE-2026-62022.md): WordPress Tonda Membership plugin \<= 1.0.1 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-28152](https://cve.now/CVE-2026-28152.md): WordPress Tonda Core plugin \< 2.6 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-28151](https://cve.now/CVE-2026-28151.md): WordPress Tonda theme \< 2.6 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-65477](https://cve.now/CVE-2026-65477.md): WordPress Tonda Core plugin \<= 2.1.2 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57805](https://cve.now/CVE-2026-57805.md): WordPress Tonda theme \<= 2.5 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57803](https://cve.now/CVE-2026-57803.md): WordPress Struktur Core plugin \< 2.7 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57802](https://cve.now/CVE-2026-57802.md): WordPress Struktur theme \< 2.7 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57801](https://cve.now/CVE-2026-57801.md): WordPress SetSail theme \<= 2.1 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-40752](https://cve.now/CVE-2026-40752.md): WordPress Manufaktur Solutions theme \<= 1.1.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39560](https://cve.now/CVE-2026-39560.md): WordPress Hiroshi theme \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39573](https://cve.now/CVE-2026-39573.md): WordPress Mildhill theme \<= 1.5 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39545](https://cve.now/CVE-2026-39545.md): WordPress Zermatt theme \<= 1.6.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39580](https://cve.now/CVE-2026-39580.md): WordPress Micdrop theme \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39567](https://cve.now/CVE-2026-39567.md): WordPress Santé theme \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-39547](https://cve.now/CVE-2026-39547.md): WordPress Getaway theme \< 1.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-39553](https://cve.now/CVE-2026-39553.md): WordPress WaveRide theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-32502](https://cve.now/CVE-2026-32502.md): WordPress Borgholm theme \< 1.6 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-25458](https://cve.now/CVE-2026-25458.md): WordPress Moments theme \<= 2.2 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-25457](https://cve.now/CVE-2026-25457.md): WordPress Mixtape theme \<= 2.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22449](https://cve.now/CVE-2026-22449.md): WordPress Don Peppe theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22446](https://cve.now/CVE-2026-22446.md): WordPress Prowess theme \<= 1.8.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22423](https://cve.now/CVE-2026-22423.md): WordPress SetSail theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-69407](https://cve.now/CVE-2025-69407.md): WordPress Struktur theme \<= 2.5.1 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-24531](https://cve.now/CVE-2026-24531.md): WordPress Prowess theme \<= 2.3 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-22450](https://cve.now/CVE-2026-22450.md): WordPress Don Peppe theme \<= 1.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-22447](https://cve.now/CVE-2026-22447.md): WordPress Prowess theme \<= 1.8.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-69029](https://cve.now/CVE-2025-69029.md): WordPress Struktur theme \<= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2025-68077](https://cve.now/CVE-2025-68077.md): WordPress Stockholm theme \<= 9.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-68076](https://cve.now/CVE-2025-68076.md): WordPress Stockholm Core plugin \<= 2.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-68068](https://cve.now/CVE-2025-68068.md): WordPress Stockholm theme \<= 9.14.1 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68067](https://cve.now/CVE-2025-68067.md): WordPress Stockholm Core plugin \<= 2.4.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-67539](https://cve.now/CVE-2025-67539.md): WordPress Select Core plugin \< 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-67521](https://cve.now/CVE-2025-67521.md): WordPress Select Core plugin \< 2.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-39463](https://cve.now/CVE-2025-39463.md): WordPress Dessau theme \< 1.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-1564](https://cve.now/CVE-2025-1564.md): SetSail Membership \<= 1.0.3 - Authentication Bypass via Account Takeover (CVSS 9.8)
- [CVE-2024-34554](https://cve.now/CVE-2024-34554.md): WordPress Stockholm Core plugin \<= 2.4.1 - Local File Inclusion vulnerability (CVSS 8.5)
- [CVE-2024-34552](https://cve.now/CVE-2024-34552.md): WordPress Stockholm theme \<= 9.6 - Local File Inclusion vulnerability (CVSS 8.5)
- [CVE-2024-34551](https://cve.now/CVE-2024-34551.md): WordPress Stockholm theme \<= 9.6 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0)
- [CVE-2024-34553](https://cve.now/CVE-2024-34553.md): WordPress Stockholm Core plugin \<= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/select-themes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.