CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes Theme = 4.4.0 - Privilege Escalation 🔥 Vulnerability Summary The WordPress theme RealHomes versions = 4.4.0 is vulnerable to a privilege escalation vulnerability. This allows authenticated users with low privileges such as subscribers to escalate their roles to...

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover 📌 Themes Information Plugin : Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover Vulnerable Version : = 5.6.67 CVE : CVE-2025-4322 Severity : 9.8...

CVE-2026-13764

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the masterstudymsstmsetdiscardtransient AJAX action. This makes it possible for...

CVE-2023-45657

CVE-2023-45657 Nexter = 2.0.3 - Authenticated Subscriber+ SQL Injection via 'to' and 'from' Description: The Nexter theme for WordPress is vulnerable to SQL Injection via the 'to' and 'from' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied...

CVE-2024-43998

CVE-2024-43998 Blogpoet = 1.0.2 - Missing Authorization via blogpoetinstallandactivateplugins Published: 2024-08-29 00:00:00 Classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N cvss-score: 5.3 cve-id: CVE-2024-43998 cpe: cpe:2.3:a:blogpoet:blogpoet:::::::: cwe-id: CWE-862...

CVE-2026-13764 Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the masterstudymsstmsetdiscardtransient AJAX action. This makes it possible for...

CVE-2026-13764

The Masterstudy - Education WordPress Theme for WordPress (versions up to and including 4.8.151 ) is vulnerable to Privilege Escalation due to missing authorization and nonce validation on the masterstudy_ms_stm_set_discard_transient AJAX action. This flaw allows authenticated attackers with Subs...

EUVD-2026-124350

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the masterstudymsstmsetdiscardtransient AJAX action. This makes it possible for...

CVE-2025-8359

CVE-2025-8359 AdForest Repo: Nxploited/CVE-2025-8359 Exploit Script: CVE-2025-8359.py 📋 Description CVE: CVE-2025-8359 Vulnerability Type: Authentication Bypass Affected Product: AdForest - Classified Ads WordPress Theme Affected Versions: Up to and including 6.0.9 CVSS Score: 9.8 Critical The...

CVE-2025-4606

CVE-2025-4606 Overview This tool is used to test the vulnerability CVE-2025-4606 in WordPress using the Sala – Startup & SaaS WordPress Theme. This vulnerability allows Privilege Escalation through Account Takeover because the theme does not properly validate user identity before updating sensiti...

WordPress Masterstudy - Education WordPress Theme theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability

WordPress Masterstudy - Education WordPress Theme theme = 4.8.151 - Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by lhking in WordPress Theme Masterstudy versions = 4.8.151...

CVE-2024-32444

CVE-2024-32444 As of 24/01/25 this vulnerabiltiy does not have a patch hence this is simply a product detection template as all products associated with the RealHome wordpress theme are vulnerable. The theme allows users to register new accounts via the inspiryajaxregister function, however, it...

CVE-2021-24499

CVE-2021-24499 | Workreap - Freelance Marketplace and Directory WordPress Theme 2.2.2 - Arbitrary File Upload WordPress Theme Workreap 2.2.2 - Unauthenticated File Upload Leading to Remote Code Execution A powerful and accurate mass exploitation tool for CVE-2021-24499 vulnerability in WordPress...

CVE-2025-1307

Newscrunch Exploit CVE-2025-1307 🚨 Overview This exploit targets a critical vulnerability CVE-2025-1307 in the Newscrunch WordPress theme. The flaw allows authenticated users Subscriber and above to upload arbitrary files due to missing capability checks in the newscrunchinstallandactivateplugin...

CVE-2026-6279.py

Description This Python script is an exploit tool for CVE-2026-6279 targeting Avada Builder = 3.15.2. Key behavior: scans targets for fusionloadnonce via Avada-specific shortcode/page patterns discovers AJAX endpoint and origin IP bypass if Cloudflare blocks admin-ajax builds exploit requests for...

CVE-2025-6758

Real Spaces - WordPress Properties Directory Theme ≤ 3.6 Unauthenticated Privilege Escalation to Administrator via imicagentregister 📝 Description CVE-2025-6758 CVSS Score: 9.8 Critical The Real Spaces - WordPress Properties Directory Theme for WordPress is vulnerable to privilege escalation via...

WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by beopseong.kim in WordPress Theme vice versions = 1.4...

WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by beopseong.kim in WordPress Theme vdequator versions = 1.2.7...

WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by beopseong.kim in WordPress Theme Mazino versions = 1.1...

WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by beopseong.kim in WordPress Theme Appointment Dark versions = 1.3.4...