WordPress Masterstudy Theme < 4.8.126 is vulnerable to Local File Inclusion

Software Masterstudy Type Theme Vulnerable versions 4.8.126 Fixed in 4.8.126 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2025-64364 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID c61c79de05c6 Credits João Pedro S Alcântara Kinorth...

WordPress Jannah theme <= 7.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Jannah versions = 7.6.0...

EUVD-2025-36628

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through 19.9.9.1...

EUVD-2025-36626

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.17...

CVE-2025-64197

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through 19.9.9.1...

CVE-2025-64200

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.17...

CVE-2025-64286 WordPress WP Rentals theme <= 3.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a through = 3.13.1...

CVE-2025-64286 WordPress WP Rentals theme <= 3.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a through = 3.13.1...

CVE-2025-64216

CVE-2025-64216 is a Local File Inclusion vulnerability in WordPress theme SmartMag (versions

CVE-2025-64204 WordPress SmartMag theme <= 10.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This issue affects SmartMag: from n/a through = 10.3.1...

CVE-2025-64204 WordPress SmartMag theme <= 10.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This issue affects SmartMag: from n/a through = 10.3.1...

CVE-2025-64204

The WordPress theme SmartMag (ThemeSphere)

CVE-2025-64202 WordPress Sahifa theme < 5.8.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue affects Sahifa: from n/a through 5.8.6...

CVE-2025-64202 WordPress Sahifa theme < 5.8.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue affects Sahifa: from n/a through 5.8.6...

CVE-2025-64202

CVE-2025-64202 relates to the WordPress Sahifa theme prior to 5.8.6. The issue is a DOM-based XSS caused by improper input neutralization during web page generation. Affected software: Sahifa (WordPress theme) versions before 5.8.6. Severity according to provided metrics is low to medium (CVSS 6....

CVE-2025-64199 WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through = 5.3.2...

CVE-2025-64199

CVE-2025-64199 describes a Missing Authorization vulnerability in the WordPress wpresidence theme (WpResidence, wpresidence) affecting versions up to 5.3.2. The underlying issue is Broken/Incorrectly Configured Access Control that could allow unauthenticated access bypass. Reported with a base CV...

CVE-2025-64195 WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThimPress Eduma eduma allows PHP Local File Inclusion.This issue affects Eduma: from n/a through = 5.7.6...

CVE-2025-64197 WordPress Rehub theme < 19.9.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through 19.9.9.1...

CVE-2025-64197

CVE-2025-64197 concerns the WordPress theme REHub. The vulnerability is a Stored XSS caused by improper input neutralization during web page generation, affecting Rehub-theme versions before 19.9.9.1 (reported by Red Hat, NVD, ENISA EUVD, CVE lists, and Patchstack). The Red Hat and NVD entries de...