5844 matches found
CVE-2025-39490
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Backpack Traveler allows PHP Local File Inclusion. This issue affects Backpack Traveler: from n/a through 2.7...
CVE-2025-39494 WordPress Wilmër theme < 3.4.2 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through 3.4.2...
CVE-2025-39494
CVE-2025-39494 refers to a Local File Inclusion vulnerability in the WordPress theme Wilmër by Mikado-Themes. The issue arises from improper control of the filename used in PHP include/require, enabling LFI via PHP Remote File Inclusion mechanics. Affected: Wilmër versions prior to 3.4.2. Evidenc...
CVE-2025-39490
CVE-2025-39490 affects Backpack Traveler (Mikado-Themes)
CVE-2025-47453
CVE-2025-47453 affects the WordPress plugin WP Smart Import (Xylus Themes) up to version 1.1.3, with a local file inclusion (LFI) vulnerability caused by improper control of Include/Require filename handling. Evidence in the CVE record and multiple connected sources confirms the vulnerability is ...
CVE-2025-47453 WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP Smart Import: from n/a through = 1.1.3...
CVE-2025-22354
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4...
CVE-2025-22267
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through = 1.0.4...
CVE-2024-33688
Cross-Site Request Forgery CSRF vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31...
CVE-2024-32597
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7...
CVE-2024-31371
Cross-Site Request Forgery CSRF vulnerability in Xylus Themes WP Event Aggregator.This issue affects WP Event Aggregator: from n/a through 1.7.6...
CVE-2024-2904
Cross-Site Request Forgery CSRF vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33...
CVE-2024-27988
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2...
CVE-2024-24871
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through = 2.0.19...
CVE-2024-33679
Cross-Site Request Forgery CSRF vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5...
CVE-2024-35633
Server-Side Request Forgery SSRF vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through = 2.0.42...
CVE-2024-35162
Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...
CVE-2024-47356
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchthemes Create create allows Stored XSS.This issue affects Create: from n/a through = 2.9.1...
CVE-2024-29796
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hot Themes Hot Random Image allows Stored XSS.This issue affects Hot Random Image: from n/a through 1.8.1...