CVE-2025-4606

CVE-2025-4606 Overview This tool is used to test the vulnerability CVE-2025-4606 in WordPress using the Sala – Startup & SaaS WordPress Theme. This vulnerability allows Privilege Escalation through Account Takeover because the theme does not properly validate user identity before updating sensiti...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up...

CVE-2024-10674

CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Overview This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitra...

CVE-2024-10673

🔥 概要 このスクリプトは CVE-2024-10673 を悪用します。これは Top Store WordPress テーマ = 1.5.4 に見つかった重大な脆弱性です。この欠陥により、購読者以上のアクセス権を持つ認証済みユーザー が、保護されていない AJAX リクエストを介して任意のプラグインをインストールおよび有効化できるようになります。 ⚠️ 重大性と影響 認証なしのプラグインインストール : 購読者権限 を持つ攻撃者は、管理者の承認なしにプラグインをインストールできます。 リモートコード実行 RCE の可能性 :...

CVE-2026-13159

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user w...

CVE-2026-13159 Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user w...

CVE-2025-9049

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

CVE-2025-9049 Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

EUVD-2025-210856

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

CVE-2025-9049

Nokri – Job Board WordPress Theme (versions up to and including 1.6.4 ) is vulnerable to privilege escalation via account takeover due to a missing capability check on the nokri_account_member_permissions function. An authenticated attacker with Subscriber-level access can create new Subscriber u...

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

CVE-2026-85302

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

EUVD-2026-70596

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-84815

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Kriesi Enfold WordPress theme, affecting versions 8.0 and earlier . The flaw stems from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in a victim's brows...

CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

CVE-2026-66652

CVE-2026-66652 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeGoods Grand Tour WordPress theme, affecting versions from an unspecified start through 5.5.1 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with a network attack vector, low complexity, no required privileges, re...

CVE-2026-18550

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...