2301 matches found
CVE-2025-0170 DWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting
The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sortby' and 'token' parameters. This makes it possible for unauthenticated attackers to inject...
CVE-2025-0170
The CVE-2025-0170 entry documents a Reflected Cross-Site Scripting vulnerability in the DWT - Directory & Listing WordPress Theme (versions up to and including 3.3.3). The root cause is insufficient input sanitization and output escaping on the sort_by and token parameters, enabling unauthenticat...
PT-2025-3759 · WordPress · Dwt - Directory & Listing Wordpress Theme
Name of the Vulnerable Software and Affected Versions: DWT - Directory & Listing WordPress Theme versions up to, and including, 3.3.3 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping on the sort by and token parameters...
CVE-2025-22769
CVE-2025-22769 is tied to a Stored XSS in the WordPress plugin Multifox. The connected Red Hat/ENISA/Wordfence entries confirm an authenticated (Contributor+) Stored Cross-Site Scripting issue in Multifox, affecting versions up to 1.3.7 and described as Improper Neutralization of Input During Web...
WordPress my money theme <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme my money versions = 2.0.6...
WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme offset writing versions = 1.2...
WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme Js O3 Lite versions = 1.5.8.2...
CVE-2024-12855
The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...
CVE-2025-22334
CVE-2025-22334 describes an stored XSS in the WordPress plugin/theme setup “Education LMS” by FilaThemes. The vulnerability is classified as an improper neutralization of input during web page generation (XSS). Public details indicate the affected scope as Education LMS versions from n/a up to 0....
CVE-2024-12781
The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab1cldemoinstallpackagecontent' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated...
PT-2025-1950 · Aurum · Aurum
Name of the Vulnerable Software and Affected Versions: Aurum - WordPress & WooCommerce Shopping Theme versions prior to 4.0.3 Description: The issue concerns a missing capability check in the lab 1cl demo install package content function, allowing authenticated attackers with Subscriber-level...
WordPress TheFude theme < 1.3.8 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme TheFude - Crowdfunding & Charity WordPress Theme versions 1.3.8...
CVE-2024-38731 WordPress i-amaze theme <= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7...
CVE-2024-38731
CVE-2024-38731 is a CSRF vulnerability in the WordPress theme i-amaze by Marsian, affecting versions up to 1.3.7 (and “n/a through 1.3.7” as stated). The CVSS metrics indicate a network attack vector, no confidentiality impact, and a partial integrity impact with a required user interaction, yiel...
CVE-2024-38732 WordPress Patricia Blog theme <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through 1.2...
CVE-2024-38764 WordPress i-transform theme <= 3.0.9 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9...
CVE-2024-38764
CVE-2024-38764 affects WordPress i-transform theme (≤3.0.9). The connected records confirm a CSRF vulnerability tied to the i-transform theme, with the CVE description stating cross-site request forgery is possible. Public materials list the affected component and indicate a CSRF risk, but the so...
CVE-2024-38763 WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through = 1.1.1...
CVE-2024-38763 WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Themes4WP Popularis Verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through 1.1.1...