WordPress Celestial Aura Theme 2.2 Shell Upload

WordPress Celestial Aura Theme versions 2.2 and below suffer from a remote shell upload vulnerability...

WordPress Spare Theme <= 1.7 is vulnerable to PHP Object Injection

Software Spare Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31919 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 56b785ef822a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...

CVE-2023-25999

CVE-2023-25999 : Local File Inclusion in BodyCenter - Gym, Fitness WooCommerce WordPress Theme (

WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme CozyStay versions 1.7.1...

WordPress Petito Theme <= 1.6.2 is vulnerable to Local File Inclusion

Software Petito Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-27362 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 93ad82bdf854 Credits Phat RiO - BlueRock Required privilege Unauthenticat...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4601 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08bda80a3ca8 Credits Thái An Require...

WordPress GiftXtore Theme <= 1.7.4 is vulnerable to Local File Inclusion

Software GiftXtore Type Theme Vulnerable versions = 1.7.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28888 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1128d46c2de9 Credits Phat RiO - BlueRock Required privilege...

CVE-2025-1778 Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete

The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'artthemethemeoptionrestore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delet...

WordPress Soho Hotel Theme <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Soho Hotel Type Theme Vulnerable versions = 4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39539 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f1eee5277067 Credits Bonds Required privilege Unauthenticated...

CVE-2025-4797

The CVE CVE-2025-4797 concerns the Golo - City Travel Guide WordPress Theme. A privilege-escalation vulnerability in which the plugin fails to validate a user’s identity before setting an authorization cookie allows unauthenticated attackers to log in as arbitrary users (including admins) if they...

PT-2025-23567 · WordPress · The Golo - City Travel Guide Wordpress Theme

Name of the Vulnerable Software and Affected Versions: The Golo - City Travel Guide WordPress Theme version 1.7.0 and earlier Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to setting an authorizatio...

WordPress Lesya Theme <= 1.7.2 is vulnerable to Local File Inclusion

Software Lesya Type Theme Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID b9712c5f2cb9 Credits Bonds Required privilege Unauthenticated Published ...

WordPress Solar Energy Theme <= 3.5 is vulnerable to PHP Object Injection

Software Solar Energy Type Theme Vulnerable versions = 3.5 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-32283 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 835d026bbefc Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Course Builder Theme < 3.6.6 is vulnerable to PHP Object Injection

Software Course Builder Type Theme Vulnerable versions 3.6.6 Fixed in 3.6.6 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-48336 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 330f3e0387ca Credits Annn Required privilege Unauthenticated...

CVE-2025-31633 WordPress Kiamo - Responsive Business Service WordPress Theme <= 1.3.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a throu...

CVE-2025-32285 WordPress Butcher theme < 2.54 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue affects Butcher: from n/a through 2.54...

CVE-2024-5567

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t...

CVE-2024-1357

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auxtimeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as...

CVE-2024-2347

The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

CVE-2024-2476

The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadthemepanelpane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose...