JobMonster < 4.5.2.9 - Cross-Site Scripting

In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. id: CVE-2022-1170 info: name: JobMonster 4.5.2.9 - Cross-Site Scripting author: Akincibor,ritikchaddha severity: medium description: | In the theme JobMonste...

WordPress Core 5.0.0 - Crop-image Shell Upload

WordPress through 5.0.3 allows Path Traversal in wpcropimage. An attacker who has privileges to crop an image can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. i...

ScoreMe Theme - Cross-Site Scripting

WordPress ScoreMe theme through 2016-04-01 contains a reflected cross-site scripting vulnerability via the s parameter which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

WordPress Newspaper < 12 - Cross-Site Scripting

WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized...

WordPress 15Zine <3.3.0 - Cross-Site Scripting Detection

WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cbsa AJAX action. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress 15Zine before 3.""" from kittysploit import...

WordPress Twenty Nineteen - Full Path Disclosure Detection

The WordPress Twentytwenty themes was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Twentytwenty themes was detected to be vulnerable to Full Path Disclosure, allowing...

WordPress Storefront Theme - Full Path Disclosure Detection

The Storefront theme for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Storefront theme...

Newspaper Theme 6.4–6.7.1 - Privilege Escalation Detection

Newspaper Theme versions 6.4 to 6.7.1 for WordPress lacked proper options access control through tdajaxupdatepanel, which led to a Privilege Escalation vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Newspaper Theme versions 6.""" from kittysploit import from...

WordPress ProStore <1.1.3 - Open Redirect Detection

WordPress ProStore theme before 1.1.3 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress ProStore theme...

Reality Estate Multipurpose WP-Theme < 2.5.3 - Cross-Site Scripting Detection

Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

WordPress Eatery 2.2 - Open Redirect Detection

WordPress Eatery theme 2.2 contains an open redirect vulnerability. The theme accepts a user-controlled input that specifies a link to an external site. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...

WordPress Diarise 1.5.9 - Arbitrary File Retrieval Detection

WordPress Diarise theme version 1.5.9 suffers from a local file retrieval vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Diarise theme version 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

PT-2025-42674

Name of the Vulnerable Software and Affected Versions Appointments plugin for WordPress versions up to and including 2.2.1 Description The Appointments plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input received from the wpmudev appointments...

EUVD-2011-3817

Malware in sbrugna...

EUVD-2024-17117

Malicious code in bioql PyPI...

EUVD-2025-12131

Malicious code in bioql PyPI...

CVE-2024-1360

The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrect nonce validation on the colibriwpinstallplugin function. This makes it possible for unauthenticated attackers to install recommended...

CVE-2024-13307

The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'realesdeletefile', 'realesdeletefileplans', 'realesaddtofavourites', and 'realesremovefromfavourites' functions in all versions up...

CVE-2024-13307 Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates

The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'realesdeletefile', 'realesdeletefileplans', 'realesaddtofavourites', and 'realesremovefromfavourites' functions in all versions up...

CVE-2024-13307 Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates

The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'realesdeletefile', 'realesdeletefileplans', 'realesaddtofavourites', and 'realesremovefromfavourites' functions in all versions up...