All packages
Boutique vulnerabilities
3 known CVE vulnerabilities in Boutique, translated and rated.
- CVE-2026-62099High
The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
- CVE-2026-62098Medium
The Boutique plugin in versions up to 2.3.3 contains an unauthenticated content injection vulnerability. An unauthenticated attacker can inject arbitrary content.
- CVE-2026-39613High
The Boutique (kute-boutique) WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS