CVE-2023-25998

CVE-2023-25998 describes an unauthenticated Local File Inclusion (LFI) in the WordPress theme “Samex - Clean, Minimal Shop WooCommerce” (and its variants) due to improper control of filenames used by include/require in PHP. Affected versions: n/a through 2.6. The issue enables PHP local file incl...

WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability

WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme = 2.6 - Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Samex - Clean, Minimal Shop WooCommerce WordPress Theme versions = 2.6...

WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability

WordPress MBStore - Digital WooCommerce WordPress Theme = 2.3 - Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme MBStore - Digital WooCommerce WordPress Theme versions = 2.3...

WordPress plugin Zagg - Electronics & Accessories WooCommerce WordPress Theme Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-28945

CVE-2025-28945 affects the Valen - Sport, Fashion WooCommerce WordPress Theme (

CVE-2025-28945 WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme valen allows PHP Local File Inclusion.This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a...

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme = 2.4 - Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Valen - Sport, Fashion WooCommerce WordPress Theme versions = 2.4...

CVE-2025-22801

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through = 1.2.8...

CVE-2023-0503

The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

CVE-2023-32242

Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36...

CVE-2024-13810

The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zassimportzass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with...

CVE-2024-13811

The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafkaimportlafka' AJAX actions in all versions up to, and including, 4.5.7. This makes it possible for authenticated attacker...

CVE-2024-13810

The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zassimportzass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with...

CVE-2024-13810 Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import

The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zassimportzass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with...

CVE-2024-13810

CVE-2024-13810 affects Zass - WooCommerce Theme for WordPress (Zass theme) up to version 3.9.9.10. Networks: missing capability check on the zass_import_zass AJAX actions allows authenticated attackers with Subscriber-level access or higher to import demo content and overwrite the site. Connected...

CVE-2024-13797

The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2025-22801

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through = 1.2.8...

CVE-2025-22801 WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through = 1.2.8...

CVE-2025-22801

CVE-2025-22801 is a Stored XSS vulnerability in HasThemes Free WooCommerce Theme 99fy Extension, affecting Free WooCommerce Theme 99fy Extension versions from unknown/n-a up to 1.2.8. Root cause is improper input neutralization during web page generation. Public details in Red Hat and Wordfence r...

CVE-2025-22801 WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through = 1.2.8...