11783 matches found
CVE-2025-69060
CVE-2025-69060 describes an Unrestricted Local File Inclusion in AncoraThemes uReach (WordPress theme/plugin: ureach). The root cause is Improper Control of Filename for Include/Require in a PHP program, enabling a PHP Local File Inclusion condition. Affected: uReach versions up to and including ...
CVE-2025-69052 WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for...
CVE-2025-69051 WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through 2.9.11...
CVE-2025-69043 WordPress Rashy theme <= 1.1.3 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Rashy rashy allows PHP Local File Inclusion.This issue affects Rashy: from n/a through = 1.1.3...
CVE-2025-69042 WordPress Lindo theme <= 1.2.5 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Lindo lindo allows PHP Local File Inclusion.This issue affects Lindo: from n/a through = 1.2.5...
CVE-2025-69042
CVE-2025-69042 affects WordPress theme Lindo (GoalThemes) up to 1.2.5. The issue is an improper control of filenames for include/require statements in PHP, enabling Local File Inclusion (LFI) via the theme’s PHP code. The impact is described as PHP Local File Inclusion affecting Lindo; specific e...
CVE-2025-69039
CVE-2025-69039 is an unauthenticated Local File Inclusion vulnerability in the WordPress theme Bailly (DesignThemes Bailly/Bailly) affecting versions up to and including 1.3.4. The issue arises from improper control of the filename used in PHP include/require statements, enabling an attacker to p...
CVE-2025-69036
Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through = 16.4...
CVE-2025-69037
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through = 1.2.3...
CVE-2025-69002
Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through = 3.9...
CVE-2025-68912
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through = 1.6.1...
CVE-2025-68986
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through = 1.2.7...
CVE-2025-68999 WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through = 3.20.4...
CVE-2025-68882 WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Scalenut Scalenut scalenut allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scalenut: from n/a through = 1.1.5...
CVE-2025-68866
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n/a through = 1.18...
CVE-2025-68866 WordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n/a through = 1.18...
CVE-2025-68869
CVE-2025-68869 refers to an unauthenticated Privilege Escalation in LazyTasks (LazyTasks project-task-management) by LazyCoders LLC, affecting versions up to and including 1.4.01. The issue enables total Privilege Escalation with high impact (CVSS v3.1: 9.8, network access, no user interaction). ...
CVE-2025-68507 WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability
Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through = 3.1.35...
CVE-2025-68507
CVE-2025-68507 : Missing Authorization in Icegram Engage (WordPress plugin) allows an unauthenticated attacker to exploit incorrectly configured access control. The vulnerability affects Icegram Engage up to and including version 3.1.35. Red Hat and CVE records corroborate the issue and its affec...