WordPress Luxe premium theme <= 1.32 - Unauthenticated Arbitrary File Upload and Option Deletion

Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Luxe premium theme versions = 1.32. Solution Update the WordPress Luxe premium theme to the latest available version at least 2.0.0...

WordPress Wyzi premium theme <= 2.4.2 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Daniel Ruf in WordPress Wyzi premium theme versions = 2.4.2. Solution Update the WordPress Wyzi premium theme to the latest available version at least 2.4.3...

WordPress EasyBook premium theme <= 1.2.1 - Persistent Cross-Site Scripting (XSS) vulnerability

Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress EasyBook premium theme versions = 1.2.1. Solution Update the WordPress EasyBook premium theme to the latest available version at least 1.2.2...

WordPress EasyBook premium theme <= 1.2.1 - Persistent Cross-Site Scripting (XSS) vulnerability

Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress EasyBook premium theme versions = 1.2.1. Solution Update the WordPress EasyBook premium theme to the latest available version at least 1.2.2...

WordPress Wibar premium theme <= 1.1.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Ilca Lucian Florin in WordPress Wibar premium theme versions = 1.1.8. Solution 2020-11-30 - we were unable to find information about the patched version of this premium theme...

WordPress Love Travel premium theme <= 3.8 - Unauthenticated Reflected Cross-Site Scripting (XSS) and Cross-Frame Scripting (XFS) vulnerabilities

Unauthenticated Reflected Cross-Site Scripting XSS and Cross-Frame Scripting XFS vulnerabilities found by Ex.Mi in WordPress Love Travel premium theme versions = 3.8. Solution 2020-11.12 - we were unable to find information about the patched version of this theme...

WordPress Greenmart premium theme <= 2.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by ErwanLR WPScan in WordPress Greenmart premium theme versions = 2.5.1. Solution Update the WordPress Greenmart premium theme to the latest available version at least 2.5.2...

WordPress Greenmart premium theme <= 2.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Cyber Security Works Pvt. Ltd in WordPress Greenmart premium theme versions = 2.4.2. Solution Update the WordPress Greenmart premium theme to the latest available version at least 2.4.3...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

WordPress 15zine premium theme <= 3.2.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Fariq Fadillah Gusti Insani in WordPress 15zine premium theme versions = 3.2.2. Solution Update the WordPress 15zine premium theme to the latest available version at least 3.3.0...

WordPress Home Villas premium theme <= 2.1 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress Home Villas premium theme versions = 2.1. Solution Update the WordPress Home Villas premium theme to the latest available version at least 2.2...

WordPress Divi premium theme <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Divi premium theme versions = 4.5.2. Solution Update the WordPress Divi premium theme to the latest available version at least 4.5.3...

WordPress Extra premium theme <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Extra premium theme versions = 4.5.2. Solution Update the WordPress Extra premium theme to the latest available version at least 4.5.3...

WordPress Findus premium theme <= 1.1.14 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress Findus premium theme versions = 1.1.14. Solution Update the WordPress Findus premium theme to the latest available version at least 1.1.15...

WordPress Jetapo premium theme <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress Jetapo premium theme versions = 1.0. Solution Update the WordPress Jetapo premium theme to the latest available version at least 1.1...

WordPress Workio premium theme <= 1.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Vlad Vector in WordPress Workio premium theme versions = 1.0.2. Solution Update the WordPress Workio premium theme to the latest available version at least 1.0.3...

WordPress Findgo premium theme <= 1.3.30 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress Findgo premium theme versions = 1.3.30. Solution Update the WordPress Findgo premium theme to the latest available version at least =1.3.32...

WordPress Kormosala premium theme <= 1.0.22 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress Kormosala premium theme versions = 1.0.22. Solution Update the WordPress Kormosala premium theme to the latest available version at least 1.0.23...

WordPress InJob premium theme <= 3.4.0 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress InJob premium theme versions = 3.4.0. Solution Update the WordPress InJob premium theme to the latest available version at least 3.4.1...