WordPress Home Villas Theme <= 2.8 is vulnerable to Arbitrary File Deletion

Software Home Villas Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Deletion CVE CVE-2025-5014 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID cba250cec63a Credits Thái An Required privilege Subscriber Published...

WordPress Elessi Theme < 6.4.1 is vulnerable to Local File Inclusion

Software Elessi Type Theme Vulnerable versions 6.4.1 Fixed in 6.4.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49070 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 75ce19994f60 Credits Phat RiO - BlueRock Required privilege Subscriber...

WordPress Diza Theme <= 1.3.9 is vulnerable to Local File Inclusion

Software Diza Type Theme Vulnerable versions = 1.3.9 Fixed in 1.3.11 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-52729 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 99cb58072740 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress CouponXxL Theme <= 3.0.0 is vulnerable to PHP Object Injection

Software CouponXxL Type Theme Vulnerable versions = 3.0.0 Fixed in 3.1.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-52725 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 04cffe8dee73 Credits Bonds Required privilege Unauthenticated...

WordPress Classiera Theme <= 4.0.34 is vulnerable to SQL Injection

Software Classiera Type Theme Vulnerable versions = 4.0.34 Fixed in 4.0.35 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2025-52722 Patch priority High CVSS severity High 9.3 Developer Joinwebs PSID bef854c7c688 Credits Lê Quốc Bảo Required privilege Unauthenticated Published 1...

DEBIAN-CVE-2025-6554

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

WordPress MobiLoud plugin <= 4.6.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin MobiLoud versions = 4.6.6...

WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by LVT-tholv2k in WordPress Plugin FW Gallery versions = 8.0.0...

WordPress Aviation Weather from NOAA plugin <= 0.7.2 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Aviation Weather from NOAA versions = 0.7.2...

WordPress LMS Theme <= 9.1 is vulnerable to SQL Injection

Software LMS Type Theme Vulnerable versions = 9.1 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2025-52833 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 1f6e9200c6d5 Credits Frank Required privilege Unauthenticated Published 30 June, 2025...

WordPress LogisticsHub Theme <= 1.1.6 is vulnerable to Arbitrary File Upload

Software LogisticsHub Type Theme Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-30933 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 5174e6750dc8 Credits Frank Required privilege Unauthenticated...

📄 Vite Local File Inclusion

Vite suffers from a local file inclusion vulnerability. This issue affected versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Titles: CVE-2025-30208 - Vite @fs LFI Local File Inclusion Vulnerability Author: nu11secur1ty Date: 01/09/2025 Vendor: https://vite.dev/ Software:...

CVE-2025-53094

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF Carriage Return Line Feed injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitize...

WordPress Game Users Share Buttons plugin <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via themeNameId Parameter vulnerability discovered by theviper17y in WordPress Plugin Game Users Share Buttons versions = 1.3.0...

WordPress PT Project Notebooks plugin 1.0.0-1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation vulnerability

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin PT Project Notebooks versions 1.0.0-1.1.3...

WordPress BeeTeam368 Extensions Pro plugin <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Directory Traversal to Arbitrary File Deletion vulnerability discovered by Tonn in WordPress Plugin BeeTeam368 Extensions Pro versions = 2.3.4...

WordPress DWT - Directory & Listing Theme <= 3.3.6 is vulnerable to Privilege Escalation

Software DWT - Directory & Listing Type Theme Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-12827 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID c0ebe5820838 Credit...

WordPress Red Art Theme <= 3.7 is vulnerable to PHP Object Injection

Software Red Art Type Theme Vulnerable versions = 3.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-52828 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 443adc1cb34f Credits Frank Required privilege Subscriber Published 26 June...

WordPress Blogbyte Theme <= 1.1.1 is vulnerable to Local File Inclusion

Software Blogbyte Type Theme Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49275 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 149a2dc2444b Credits Le Ngoc Anh Required privilege Unauthenticated...

WordPress Blogprise Theme <= 1.0.9 is vulnerable to Local File Inclusion

Software Blogprise Type Theme Vulnerable versions = 1.0.9 Fixed in 1.0.10 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49277 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1df18a126279 Credits Le Ngoc Anh Required privilege Unauthenticated...