# cve.now: Thembay

The newest entries naming Thembay as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-66610](https://cve.now/CVE-2026-66610.md): WordPress Urna theme \<= 2.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66612](https://cve.now/CVE-2026-66612.md): WordPress Aora theme \<= 1.3.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27381](https://cve.now/CVE-2026-27381.md): WordPress Aora theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68545](https://cve.now/CVE-2025-68545.md): WordPress Nika theme \<= 1.2.14 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68543](https://cve.now/CVE-2025-68543.md): WordPress Diza theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68539](https://cve.now/CVE-2025-68539.md): WordPress Fana theme \<= 1.1.35 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68536](https://cve.now/CVE-2025-68536.md): WordPress Zota theme \<= 1.3.14 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67982](https://cve.now/CVE-2025-67982.md): WordPress Urna theme \<= 2.5.12 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67981](https://cve.now/CVE-2025-67981.md): WordPress Besa theme \<= 2.3.15 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67980](https://cve.now/CVE-2025-67980.md): WordPress Hara theme \<= 1.2.17 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68985](https://cve.now/CVE-2025-68985.md): WordPress Aora theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68984](https://cve.now/CVE-2025-68984.md): WordPress Puca theme \<= 2.6.39 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68983](https://cve.now/CVE-2025-68983.md): WordPress Greenmart theme \<= 4.2.11 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68540](https://cve.now/CVE-2025-68540.md): WordPress Fana theme \<= 1.1.35 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68537](https://cve.now/CVE-2025-68537.md): WordPress Zota theme \<= 1.3.14 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68546](https://cve.now/CVE-2025-68546.md): WordPress Nika theme \<= 1.2.14 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68544](https://cve.now/CVE-2025-68544.md): WordPress Diza theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-67532](https://cve.now/CVE-2025-67532.md): WordPress Hara theme \<= 1.2.17 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-67530](https://cve.now/CVE-2025-67530.md): WordPress Besa theme \<= 2.3.15 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-67528](https://cve.now/CVE-2025-67528.md): WordPress Urna theme \<= 2.5.12 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-48171](https://cve.now/CVE-2025-48171.md): WordPress Cena Store \<= 2.11.26 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-54689](https://cve.now/CVE-2025-54689.md): WordPress Urna Theme \<= 2.5.7 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-30992](https://cve.now/CVE-2025-30992.md): WordPress Puca theme \<= 2.6.33 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49883](https://cve.now/CVE-2025-49883.md): WordPress Greenmart theme \<= 4.2.3 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-52729](https://cve.now/CVE-2025-52729.md): WordPress Diza theme \<= 1.3.9 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49251](https://cve.now/CVE-2025-49251.md): WordPress Fana theme \<= 1.1.28 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49252](https://cve.now/CVE-2025-49252.md): WordPress Besa theme \<= 2.3.8 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49253](https://cve.now/CVE-2025-49253.md): WordPress Lasa theme \<= 1.1 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49254](https://cve.now/CVE-2025-49254.md): WordPress Nika theme \<= 1.2.8 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49255](https://cve.now/CVE-2025-49255.md): WordPress Ruza theme \<= 1.0.7 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49256](https://cve.now/CVE-2025-49256.md): WordPress Sapa theme \<= 1.1.14 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49257](https://cve.now/CVE-2025-49257.md): WordPress Zota theme \<= 1.3.8 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49258](https://cve.now/CVE-2025-49258.md): WordPress Maia theme \<= 1.1.15 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49259](https://cve.now/CVE-2025-49259.md): WordPress Hara theme \<= 1.2.10 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49260](https://cve.now/CVE-2025-49260.md): WordPress Aora theme \<= 1.3.9 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49261](https://cve.now/CVE-2025-49261.md): WordPress Diza theme \<= 1.3.8 - Local File Inclusion Vulnerability (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/thembay
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.