5845 matches found
PT-2025-27023 · Unknown · Juzawebcms
Name of the Vulnerable Software and Affected Versions: juzaweb CMS version 3.4.2 Description: A critical vulnerability was found in juzaweb CMS, affecting an unknown functionality of the file /admin-cp/theme/install of the component Add New Themes Page. The manipulation leads to improper...
CVE-2025-50009
Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through = 1.5.3...
CVE-2025-50030
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from n/a through = 1.0.7...
CVE-2025-50033
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through = 1.1.1...
CVE-2025-5289
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes ...
CVE-2025-5289
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes ...
CVE-2025-5289
The WordPress plugin 3D FlipBook (Lite Edition) – including PDF Embedder, PDF Flipbook Viewer, and Flipbook Image Gallery, version
CVE-2025-5289 3D FlipBook - Lite Edition <= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes ...
CVE-2025-50030
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from n/a through = 1.0.7...
CVE-2025-50033
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through = 1.1.1...
CVE-2025-50009
Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through = 1.5.3...
CVE-2025-50009
CVE-2025-5009 (Kata Plus) : WordPress Kata Plus add-ons (1.5.3 and earlier) suffer a Missing Authorization/broken access control vulnerability. Root cause is incorrectly configured access control levels allowing unauthorized actions. Affected software: Kata Plus – Addons for Elementor – Widgets, ...
CVE-2025-50030
CVE-2025-50030 corresponds to a DOM-Based XSS in the Spark Multipurpose WordPress theme (Sparkle Themes). Public details confirm improper input neutralization during web page generation, affecting Spark Multipurpose versions up to 1.0.7 (no fixed version listed). Reported CVSS v3.1 vector yields ...
CVE-2025-50033
CVE-2025-50033 affects the WordPress Fitness Park theme (versions n/a through 1.1.1). It is a DOM-based XSS caused by improper input neutralization during web page generation. Multiple sources (Wordfence, Patchstack, CVE listings) confirm the vulnerability and note that a patch is not available y...
PT-2025-26366 · Climax Themes · Climax Themes Kata Plus
Name of the Vulnerable Software and Affected Versions: Climax Themes Kata Plus versions 1.5.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For Climax Themes...
PT-2025-26386 · Unknown · Sparkle Themes Fitness Park
Name of the Vulnerable Software and Affected Versions: Sparkle Themes Fitness Park versions n/a through 1.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attack...
CVE-2025-49295
Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through = 2.1...
CVE-2025-49296
Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through = 1.6...