Deothemes Ona vulnerabilities

• deothemes ona Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter CVE-2026-6812 4.4 MediumMay 2, 2026
• deothemes ona WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability CVE-2026-32482 9.9 CriticalMarch 25, 2026