19633 matches found
CVE-2025-67920 WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through 1.2...
CVE-2025-67921
CVE-2025-67921 : The WordPress theme/plugin Lobo (Lobo – WordPress Portfolio for Freelancers & Agencies) contains an authenticated SQL injection vulnerability. Affected versions are those with
CVE-2025-67921 WordPress Lobo theme < 2.8.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through 2.8.6...
CVE-2025-67920 WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through 1.2...
CVE-2025-67920
CVE-2025-67920 concerns an unauthenticated Local File Inclusion in the WordPress theme Neo Ocular (Elated-Themes) via improper filename handling in PHP includes. Affected: Neo Ocular
CVE-2025-67921 WordPress Lobo theme < 2.8.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through 2.8.6...
CVE-2025-67916
CVE-2025-67916 affects the WordPress Theme Jobify (Job Board) up to version 4.3.0. The issue is a Reflected XSS vulnerability caused by improper input handling during web page generation. Impact per sources: potential script execution in a user’s browser. Mitigation: patch deployed in Jobify 4.3....
CVE-2025-67918
CVE-2025-67918 affects the WordPress/Woffice ecosystem (Woffice theme) with a reflected XSS in the Woffice CRM product. Root cause: improper input neutralization during web page generation. Impact notes from the sources indicate High risk (CVSS 3.1 base score 7.1) affecting Woffice releases up to...
CVE-2025-67918 WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through = 5.4.30...
CVE-2025-67916 WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through = 4.3.0...
CVE-2025-67916 WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through = 4.3.0...
CVE-2025-67917 WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through = 3.2.6...
CVE-2025-67917
CVE-2025-67917 describes a Missing Authorization vulnerability in Travel Traveler (Travel Booking WordPress Theme), affecting Travel Traveler up to version 3.2.6. The root cause is incorrectly configured access control that could allow unauthorized access to certain resources. Wordfence documenta...
CVE-2025-67917 WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through = 3.2.6...
CVE-2025-67918 WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through = 5.4.30...
CVE-2025-67914 WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability
Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through = 2.3.8...
CVE-2025-67914 WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability
Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through = 2.3.8...
CVE-2025-23993
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through = 1.1.3...
CVE-2025-22712 WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through = 3.0.2...