CVE-2025-64188

CVE-2025-64188 affects the WordPress plugin/theme PenciDesign Soledad (versions n/a–8.6.9). Root cause: incorrect privilege assignment that enables privilege escalation. Impact: subscribers can potentially take over WordPress sites. Remediation: update Soledad to a version later than 8.6.9 (per P...

CVE-2025-64192 WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through 9.6...

CVE-2025-64193

CVE-2025-64193 affects WordPress XStore plugin vulnerabilities: an improper control of filenames for PHP include/require leads to Local File Inclusion in XStore versions prior to 9.6.1. The issue is described as a PHP Remote File Inclusion-type flaw that enables LFI within the XStore code path. A...

CVE-2025-64193 WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.6.1...

CVE-2025-64192

CVE-2025-64192 affects the WordPress XStore theme (XStore) with versions prior to 9.6. The issue is a Missing Authorization vulnerability caused by broken access control, allowing exploitation due to improperly configured access levels. Public documentation in the connected sources confirms the i...

CVE-2025-64192 WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through 9.6...

CVE-2025-64191 WordPress XStore theme < 9.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through 9.6.1...

CVE-2025-6326 WordPress Inset theme <= 1.18.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Inset inset allows PHP Local File Inclusion.This issue affects Inset: from n/a through = 1.18.0...

CVE-2025-63039

CVE-2025-63039 corresponds to a Missing Authorization (Broken Access Control) vulnerability in the WordPress ListingPro theme (ListingPro: ≤2.9.9). Red Hat and ENISA records corroborate the issue affecting ListingPro versions up to 2.9.9 due to incorrectly configured access control security level...

CVE-2025-63039 WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through = 2.9.9...

CVE-2025-6326

CVE-2025-6326 affects WordPress Inset theme (and related Inset components) up to version 1.18.0, exposing a PHP Local File Inclusion via improper control of the filename for include/require. The vulnerability enables access to local files due to an insecure inclusion mechanism. The provided docum...

CVE-2025-60070 WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through = 1.5.13...

CVE-2025-60070 WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through = 1.5.13...

CVE-2025-60071 WordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through = 1.6.23...

CVE-2025-60069

CVE-2025-60069 concerns the WordPress MinimogWP theme (minimog) up to version 3.9.6. The issue is an improper control of filenames for include/require statements, enabling PHP Local File Inclusion (LFI) via the theme’s code. The vulnerability is described as a PHP Local File Inclusion in MinimogW...

CVE-2025-60070

CVE-2025-60070 concerns The4 Molla (WordPress theme/plugin Molla) with versions up to and including 1.5.13, where improper control of code generation enables code injection (arbitrary code execution). References consistently describe this as a vulnerability affecting Molla versions ≤ 1.5.13. The ...

CVE-2025-60069 WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through = 3.9.6...

CVE-2025-60067

CVE-2025-60067 is a local/file inclusion vulnerability in the WordPress Giardino theme (versions &lt;= 1.1.10). The issue is described as Improper Control of Filename for Include/Require Statement in PHP, enabling PHP Local File Inclusion. Affected product/component: WordPress Giardino theme; roo...

CVE-2025-60067 WordPress Giardino theme <= 1.1.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Giardino giardino allows PHP Local File Inclusion.This issue affects Giardino: from n/a through = 1.1.10...

CVE-2025-60071 WordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through = 1.6.23...