Advisories · Technology

deothemes Ona.

Every CVE that names deothemes Ona among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-6812 CVE record

CVSS 4.4 Medium

Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
- deothemes Ona
- Server-side request forgery (SSRF)
Not analysed yet 2 May 2026
CVE-2026-32482 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability
- deothemes Ona
- Unrestricted file upload
Not analysed yet 25 Mar 2026