19430 matches found
JobMonster < 4.5.2.9 - Cross-Site Scripting
In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. id: CVE-2022-1170 info: name: JobMonster 4.5.2.9 - Cross-Site Scripting author: Akincibor,ritikchaddha severity: medium description: | In the theme JobMonste...
WordPress Page Builder KingComposer <=2.9.6 - Open Redirect
WordPress Page Builder KingComposer 2.9.6 and prior does not validate the id parameter before redirecting the user to it via the kcgetthumbn AJAX action which is available to both unauthenticated and authenticated users. id: CVE-2022-0165 info: name: WordPress Page Builder KingComposer =2.9.7 to...
CVE-2026-5093
The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...
mTheme Unus < 2.3 - Directory Traversal
The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...
WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery
WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...
CVE-2026-66672
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66612
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Koji = 2.2.1 versions...
CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647
CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...
CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
EUVD-2026-63297
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Capella = 2.5.5 versions...
CVE-2025-15689 WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...