2314 matches found
WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Peter Thaleikis in WordPress Theme Hello FSE Blog versions = 1.0.6...
WordPress Fitness Park Theme <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Software Fitness Park Type Theme Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-50033 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f81317695731 Credits Peter Thaleikis Required privilege Contribut...
WordPress Hello FSE Blog Theme <= 1.0.6 is vulnerable to Broken Access Control
Software Hello FSE Blog Type Theme Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-49970 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 248511ebb594 Credits Peter Thaleikis Required privileg...
WordPress HYDRO Theme <= 2.8 is vulnerable to Cross Site Scripting (XSS)
Software HYDRO Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31428 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d4b1bd6f0305 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...
CVE-2025-4200
The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...
CVE-2025-4973
CVE-2025-4973: The Workreap WordPress plugin (Workreap theme) is vulnerable to authentication bypass in versions up to 3.3.1. The flaw stems from improper verification of a user’s identity during email-based account verification, enabling unauthenticated attackers to log in as registered users (i...
CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreaptempuploadtomedia' function in all versions up to, and including, 3.3.2. This makes it possible for...
CVE-2025-4601
The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiryupdateprofile function. This makes it possible for...
CVE-2025-31396
Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5...
WordPress Hara theme <= 1.2.10 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Hara versions = 1.2.10...
WordPress Fana Theme <= 1.1.28 is vulnerable to Local File Inclusion
Software Fana Type Theme Vulnerable versions = 1.1.28 Fixed in 1.1.29 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-49251 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ee30ced0791e Credits Phat RiO - BlueRock Required privilege...
WordPress CozyStay Theme < 1.7.1 is vulnerable to Local File Inclusion
Software CozyStay Type Theme Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49508 Patch priority High CVSS severity High 8.1 Developer LoftOcean PSID 0ccb72a10659 Credits Bonds Required privilege Unauthenticated Published 11...
WordPress Maia Theme <= 1.1.15 is vulnerable to Local File Inclusion
Software Maia Type Theme Vulnerable versions = 1.1.15 Fixed in 1.1.16 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-49258 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 17919a5d64c7 Credits Phat RiO - BlueRock Required privilege...
WordPress Simen Theme <= 4.6 is vulnerable to Local File Inclusion
Software Simen Type Theme Vulnerable versions = 4.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-29002 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e7c41e25943d Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...
CVE-2025-4601
The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiryupdateprofile function. This makes it possible for...
CVE-2025-4601 RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation
The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiryupdateprofile function. This makes it possible for...
CVE-2025-4601
The CVE-2025-4601 entry applies to RH - Real Estate WordPress Theme (RealHomes). A privilege-escalation vulnerability exists in versions
WordPress Spare Theme <= 1.7 is vulnerable to PHP Object Injection
Software Spare Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31919 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 56b785ef822a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...
WordPress Photography Theme <= 7.5.2 is vulnerable to PHP Object Injection
Software Photography Type Theme Vulnerable versions = 7.5.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-47579 Patch priority High CVSS severity High 9 Developer EPC PSID f3488f35689e Credits Rafie Muhammad Patchstack Required privilege Unauthenticated...