CVE-2025-11746 XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion

The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theetajaxrequiredpluginspopup function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

WordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme GoStore versions 1.6.4...

WordPress Theme Importer plugin <= 1.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Importer versions = 1.0...

WordPress XStore theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by khanhhnahk1 in WordPress Theme XStore versions = 9.5.4...

PT-2025-42227

The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet ajax required plugins popup function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files ...

WordPress plugin Theme Importer 跨站请求伪造漏洞

WordPress Theme Importer plugin is mainly used to import website content such as pages, menus, images, etc. from other platforms or websites into WordPress for quick migration or rebuilding of websites. The WordPress Theme Importer plugin suffers from a cross-site request forgery vulnerability,...

CVE-2025-10312: Cross-Site Request Forgery (CSRF)

The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation when processing form submissions in the theme-importer.php file. This makes it possible for unauthenticated attackers to trigger...

WordPress WoodMart theme < 8.3.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WoodMart versions 8.3.2...

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Plugin TheGem Theme Elements for WPBakery versions = 5.10.5.1...

WordPress Newsup theme <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Installation vulnerability discovered by Dmitrii Ignatyev in WordPress Theme Newsup versions = 5.0.10...

WordPress Education WordPress Theme | HiStudy theme < 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xd4rk5id3 in WordPress Theme Education WordPress Theme | HiStudy versions 3.1.0...

Malicious code in scr-theme-production (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43b9b215ec9dee5723751b479575e1aacae2e38745b6504033b95b3da6f4f49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview scr-file-theme is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-33937

Malicious code in scr-theme-production npm...

MAL-2025-48343 Malicious code in scr-file-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e14437e272ed4d4e6bb48ac4f6b3e3cce3f5838363b09ec1e6e95400dd5812d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33936

Malicious code in simple-app-theme npm...

Malicious code in scr-file-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e14437e272ed4d4e6bb48ac4f6b3e3cce3f5838363b09ec1e6e95400dd5812d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48345 Malicious code in scr-theme-production (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43b9b215ec9dee5723751b479575e1aacae2e38745b6504033b95b3da6f4f49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33939

Malicious code in scr-file-theme npm...

Malicious Package

Overview scr-theme-production is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...