CVE-2025-53423 WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through = 2.6...

CVE-2025-53423

CVE-2025-53423 describes a Cross-Site Scripting (Reflected XSS) vulnerability in the WordPress plugin/theme designthemes Triss, affecting Triss versions up to and including 2.6. The root cause is improper neutralization of input during web page generation. Existing connected sources confirm the a...

CVE-2025-53423 WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through = 2.6...

CVE-2025-53229 WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through = 3.3...

CVE-2025-53229

CVE-2025-53229 describes a Reflected Cross-Site Scripting (XSS) weakness in the WordPress RockON DJ theme, affecting versions up to 3.3. The root cause is improper input neutralization during web page generation, enabling a reflected XSS payload when users view crafted pages. Connected sources co...

CVE-2025-53229 WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through = 3.3...

CVE-2025-49952

CVE-2025-49952 affects the WordPress plugin/theme Houzez (WordPress theme by favethemes) up to version 4.1.1. The issue is an authorization bypass caused by incorrectly configured access control, described as a user-controlled key that enables bypassing access restrictions (an insecure direct obj...

CVE-2025-49952 WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through = 4.2.5...

CVE-2025-49940 WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through = 3.13.2...

CVE-2025-49936 WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through 8.3.2...

CVE-2025-49935

CVE-2025-49935 affects WordPress WoodMart theme versions before 8.3.2 and is a Local File Inclusion (LFI) flaw caused by improper control of the filename in include/require statements (PHP Remote File Inclusion context). The issue could allow an attacker to include local files via crafted request...

CVE-2025-49936

CVE-2025-49936: WordPress WoodMart theme

CVE-2025-49935 WordPress WoodMart theme < 8.3.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in xtemos WoodMart woodmart allows PHP Local File Inclusion.This issue affects WoodMart: from n/a through 8.3.2...

CVE-2025-49926 WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through = 3.25...

CVE-2025-49926 WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through = 3.25...

CVE-2025-49926

CVE-2025-49926 concerns the WordPress Kalium theme (Kalium) up to version 3.25. Risk arises from an improper generation of code, i.e., a code injection vulnerability that can lead to arbitrary code execution. Affected component: Laborator Kalium kalium (WordPress theme/plugin variant) with versio...

CVE-2025-49060 WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through 1.1.3...

CVE-2025-49060

CVE-2025-49060 affects CMSSuperHeroes Wastia (WordPress plugin/theme) with unrestricted upload of dangerous file types, enabling potential web shell uploads. Affected: Wastia versions prior to 1.1.3. Root cause: flaw in handling uploaded file types leading to arbitrary file upload. Impact per sou...

CVE-2025-49060 WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through 1.1.3...

CVE-2025-48106 WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through 1.3.1...