PT-2025-44720

Name of the Vulnerable Software and Affected Versions kallyas versions prior to 4.23.1 Description The kallyas theme for WordPress is susceptible to Stored Cross-Site Scripting through multiple shortcodes. Insufficient input sanitization and output escaping on user-supplied attributes allows...

PT-2025-44721

Name of the Vulnerable Software and Affected Versions kallyas versions prior to 4.24.0 Description The kallyas theme for WordPress is susceptible to Remote Code Execution through the TH PhpCode pagebuilder widget. The issue arises because the theme does not restrict access to the code editor widg...

CVE-2025-6988: Improper Neutralization of Input During Web Page Generation

The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-6990: Improper Control of Generation of Code

The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the THPhpCode pagebuilder widget. This is due to the theme not restricting access to the code editor widget for non-administrators. This makes it possible for authenticated...

CVE-2025-64368

Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through = 1.6...

CVE-2025-64368 WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through = 1.6...

CVE-2025-64368

Summary: CVE-2025-64368 affects Mikado-Themes Bard Bardwp (WordPress Bard theme plugin). The vuln is a Cross-Site Request Forgery (CSRF) in Bardwp that allows an attacker to perform actions on behalf of authenticated users. Affected: Bard versions up to and including 1.6. Root cause: insufficient...

CVE-2025-64368 WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through = 1.6...

CVE-2025-64363 WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through 5.5.0...

CVE-2025-64363

CVE-2025-64363 describes a Local/Remote File Inclusion vulnerability in WordPress Kleo ecosystem (Kleo plugin/theme) caused by improper control of filename for Include/Require statements in PHP. Affected: SeventhQueen Kleo versions prior to 5.5.0. Impact: potential PHP native file inclusion leadi...

CVE-2025-64359 WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.7.5...

CVE-2025-64359

CVE-2025-64359 is a WordPress plugin/theme vulnerability affecting the WordPress Consulting theme (StylemixThemes Consulting) versions prior to 6.7.5. Multiple connected sources describe an improper control of filename for include/require statements, enabling PHP Local File Inclusion through the ...

CVE-2025-64359 WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.7.5...

CVE-2025-10897

The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read...

CVE-2025-5397

The CVE-2025-5397 entry concerns the WordPress Noo JobMonster theme. Affected versions up to 4.8.1 contain an Authentication Bypass due to the check_login() function not properly verifying user identity before authentication, allowing unauthenticated attackers to bypass login and access administr...

CVE-2025-5397 Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass

The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the checklogin function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers...

EUVD-2025-37307

The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the checklogin function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers...

CVE-2025-5397 Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass

The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the checklogin function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers...

WordPress Jobmonster Theme <= 4.8.1 is vulnerable to Broken Authentication

Software Jobmonster Type Theme Vulnerable versions = 4.8.1 Fixed in 4.8.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-5397 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 91f66baeb6e0 Credits Thái An...

WordPress Plugin Ohio Extra 跨站脚本漏洞

WordPress Ohio Extra plugin is a free WordPress plugin designed specifically for the OceanWP theme to enhance the theme functionality and improve the site building experience. WordPress Ohio Extra plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of...