CVE-2025-47531

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...

CVE-2025-47531

CVE-2025-47531 applies to the WordPress plugin “XT Event Widget for Social Events” (Xylus Themes). The issue is an improper control of filename for include/require statements, enabling Local File Inclusion. Affected versions are up to 1.1.7; exploitation context is limited to LFI within the plugi...

CVE-2025-47531 WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...

WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin Hash Form versions = 1.2.8...

WordPress Blocksy Theme <= 2.0.97 is vulnerable to Broken Access Control

Software Blocksy Type Theme Vulnerable versions = 2.0.97 Fixed in 2.0.98 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-47465 Patch priority Low CVSS severity Low 4.9 Developer Creative Themes PSID 62c34d0d694c Credits savphill Required privilege...

PT-2025-20150 · Xylus Themes · Xylus Themes Xt Event Widget For Social Events

Name of the Vulnerable Software and Affected Versions: Xylus Themes XT Event Widget for Social Events versions 1.1.7 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' or PHP Loca...

CVE-2024-13418

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that c...

CVE-2025-39385

Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: from n/a through = 1.5.1...

CVE-2025-39528

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rescue Themes Rescue Shortcodes rescue-shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through = 3.1...

CVE-2025-32572

Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through = 1.5.3...

CVE-2025-39385

Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: from n/a through = 1.5.1...

CVE-2025-39360

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in everestthemes Grace Mag grace-mag allows PHP Local File Inclusion.This issue affects Grace Mag: from n/a through = 1.1.5...

CVE-2025-39360

CVE-2025-39360 refers to a Local File Inclusion in the Grace Mag WordPress theme (versions 1.1.5 and earlier). The issue stems from improper control of filenames in PHP include/require logic, i.e., a PHP Remote File Inclusion that permits local file inclusion. Affected product: Grace Mag theme up...

CVE-2025-39385

CVE-2025-39385 (Sirat WordPress Theme) has concrete details in the connected records: a Missing Authorization vulnerability caused by misconfigured access control in the VW Themes Sirat plugin, affecting Sirat versions

PT-2025-17750 · Vw Themes · Vw Themes Sirat

Name of the Vulnerable Software and Affected Versions: VW Themes Sirat versions prior to 1.5.1 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior to 1.5.1,...

CVE-2025-39428

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome and Placeholders gravity-forms-css-themes-with-fontawesome-and-placeholder-support allows Stored XSS.This issue affects Gravity Forms CSS...

CVE-2025-32572

Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through = 1.5.3...

CVE-2025-32572 WordPress Kata Plus Plugin <= 1.5.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through = 1.5.3...

CVE-2025-32572

CVE-2025-32572 is a PHP object injection flaw caused by deserialization of untrusted data in the Kata Plus WordPress plugin family (Kata Plus – Addons for Elementor – Widgets, Extensions and Templates). Affected versions range up to 1.5.2 (with CVE entries tracking up to 1.5.3 per Patchstack/Word...

CVE-2025-32572 WordPress Kata Plus Plugin <= 1.5.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus allows Object Injection. This issue affects Kata Plus: from n/a through 1.5.2...