CVE-2024-32444

CVE-2024-32444 Stand 24.01.2025 hat diese Sicherheitslücke keinen Patch, daher ist dies lediglich eine Produkterkennungsvorlage, da alle Produkte, die mit dem RealHome WordPress-Theme verbunden sind, angreifbar sind. Das Theme ermöglicht es Benutzern, neue Konten über die...

CVE-2026-78289

CVE-2026-78289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the CozyStay WordPress theme, affecting versions 1.10.0 and earlier . The vulnerability was discovered by G0053 and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, requiring user interaction. The at...

CVE-2026-78289 WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...

CVE-2025-5394

CVE-2025-5394 CVE‑2025‑5394 WP Alone theme ≤ 7.8.3...

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. id: CVE-2021-24407 info: name: WordPress Jannah Theme 5.4.5 - Cross-Site Scripting author: pikpikcu severity:...

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

CVE-2025-49071

CVE-2025-49071 Flozen 1.5.1 - Неавторизованная произвольная загрузка файлов Описание : Flozen Theme 1.5.1 - Неавторизованная произвольная загрузка файлов Описание Тема Flozen для WordPress версии до и включая 1.5.1 уязвима к неавторизованной произвольной загрузке файлов из-за отсутствия проверок...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - AdForest WordPress Authentifizierungs-Bypass PoC Beschreibung Einfacher Proof of Concept für CVE-2026-1729 PoC - Authentifizierungs-Bypass-Schwachstelle im AdForest WordPress-Theme. Authored by f3ds cr3w est 2oo2 blog Funktionen ✅ Direkter Admin-Zugriff ohne Anmeldedaten ✅...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 – Nicht authentifizierte Privilegienausweitung 🧨 CVE-2025-39459 – Real Estate 7 = 3.5.2 Nicht authentifizierte Privilegienausweitung 📌 Überblick Dieses Repository enthält ein Python-Proof-of-Concept-Tool für CVE-2025-39459 , das das Real Estate 7 WordPress-The...

CVE-2026-6279.py

विवरण यह पायथन स्क्रिप्ट CVE-2026-6279 के लिए एक शोषण उपकरण है जो Avada Builder = 3.15.2 को लक्षित करता है। मुख्य व्यवहार: Avada-विशिष्ट शॉर्टकोड/पेज पैटर्न के माध्यम से fusionloadnonce के लिए लक्ष्यों को स्कैन करता है AJAX एंडपॉइंट और मूल IP बायपास की खोज करता है यदि Cloudflare admin-ajax को ब्ल...

CVE-2021-24499

CVE-2021-24499 | Workreap - Freelance Marketplace and Directory WordPress Theme 2.2.2 - Caricamento File Arbitrario WordPress Theme Workreap 2.2.2 - Caricamento File Non Autenticato che Porta a Esecuzione di Codice Remota Un potente e accurato strumento di sfruttamento di massa per la vulnerabili...

CVE-2024-8682

CVE-2024-8682 - JNews अनधिकृत पंजीकरण PoC JNews = 11.6.6 में एक कमजोरी है जो ?ajax-request=jnews एंडपॉइंट के माध्यम से अनधिकृत उपयोगकर्ता पंजीकरण की अनुमति देती है, भले ही WordPress पंजीकरण अक्षम हो। यह पहले jnewsrefreshnonce क्रिया के माध्यम से एक मान्य jnewsnonce प्राप्त करके काम करता है, फिर...

CVE-2025-4606

CVE-2025-4606 概述 该工具用于测试WordPress上使用 Sala – Startup & SaaS WordPress 主题 的 CVE-2025-4606 漏洞。 此漏洞允许通过账户接管（Account Takeover）实现权限提升，因为该主题在更新密码等敏感数据之前未正确验证用户身份。 因此，未经身份验证的攻击者可以更改其他用户（包括管理员）的密码，从而可能导致完全接管网站。 开发者： Ohang 感谢： @C4p333 目的： 安全研究与教育用途 安装 Termux Pydroid 3 1. 克隆或下载 root@kitploit: git clone...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Autorizzazione mancante per l'installazione/attivazione arbitraria di plugin da parte di utenti autenticati Abbonato+ Descrizione: Il tema ColorMag per WordPress è vulnerabile ad accessi non autorizzati a causa di una mancata verifica delle capacità nella funzione...

CVE-2025-1304

🚨 Tema WordPress NewsBlogger = 0.2.5.1 - Caricamento File Arbitrario CVE-2025-1304 Punteggio CVSS: 8.8 Alto Tipo di Vulnerabilità: Caricamento File Arbitrario Componente: Tema WordPress ID CVE: CVE-2025-1304 🔥 Panoramica della Vulnerabilità Il tema WordPress NewsBlogger versioni = 0.2.5.1 è...

CVE-2024-10674

CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Übersicht Dieses Repository enthält einen Exploit für die als CVE-2024-10674 identifizierte Sicherheitslücke im WordPress-Theme Th Shop Mania. Die Sicherheitslücke erlaubt authentifizierten Benutzern mit mindestens Abonnenten-Zugriff...

CVE-2024-10673

🔥 Panoramica Questo script sfrutta CVE-2024-10673 , una vulnerabilità critica presente nel Top Store WordPress Theme = 1.5.4. La falla consente a utenti autenticati con accesso a livello di abbonato o superiore di installare e attivare plugin arbitrari tramite richieste AJAX non protette. ⚠️...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Unauthentifizierte beliebige Plugin-Installation Beschreibung Das Pubnews-Theme für WordPress ist anfällig für eine unbefugte beliebige Plugin-Installation aufgrund einer fehlenden Berechtigungsprüfung in der Funktion pubnewsimporterpluginactionfornotice in allen...

CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...