CVE-2025-4606

CVE-2025-4606 Overview This tool is used to test the vulnerability CVE-2025-4606 in WordPress using the Sala – Startup & SaaS WordPress Theme. This vulnerability allows Privilege Escalation through Account Takeover because the theme does not properly validate user identity before updating sensiti...

CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes Theme = 4.4.0 - Privilege Escalation 🔥 Vulnerability Summary The WordPress theme RealHomes versions = 4.4.0 is vulnerable to a privilege escalation vulnerability. This allows authenticated users with low privileges such as subscribers to escalate their roles to...

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. id: CVE-2021-24407 info: name: WordPress Jannah Theme 5.4.5 - Cross-Site Scripting author: pikpikcu severity:...

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover 📌 Themes Information Plugin : Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover Vulnerable Version : = 5.6.67 CVE : CVE-2025-4322 Severity : 9.8...

CVE-2024-10673

🔥 概要 このスクリプトは CVE-2024-10673 を悪用します。これは Top Store WordPress テーマ = 1.5.4 に見つかった重大な脆弱性です。この欠陥により、購読者以上のアクセス権を持つ認証済みユーザー が、保護されていない AJAX リクエストを介して任意のプラグインをインストールおよび有効化できるようになります。 ⚠️ 重大性と影響 認証なしのプラグインインストール : 購読者権限 を持つ攻撃者は、管理者の承認なしにプラグインをインストールできます。 リモートコード実行 RCE の可能性 :...

CVE-2025-5394

CVE-2025-5394 CVE‑2025‑5394 WP Alone theme ≤ 7.8.3...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - 認証済み（Subscriber+）による任意のプラグインのインストール/有効化を許可する認可不足 説明: WordPress用のColorMagテーマは、バージョン3.1.2まで（およびそれを含む）の全バージョンにおいて、pluginactioncallback関数に対する機能チェックが欠如しているため、不正アクセスに対して脆弱です。これにより、購読者レベル以上のアクセス権を持つ認証済み攻撃者が任意のプラグインをインストールおよび有効化できる可能性があります。 root@kitploit: Severity: medium...

CVE-2024-10674

CVE-2024-10674 エクスプロイト - Th Shop Mania = 1.4.9 🚀 概要 このリポジトリには、Th Shop Mania WordPressテーマにおけるCVE-2024-10674として識別された脆弱性のエクスプロイトが含まれています。この脆弱性により、少なくとも購読者レベルのアクセス権を持つ認証済みユーザーが、適切な認可なしに任意のプラグインをインストールおよび有効化できるようになります。このエクスプロイトは悪意のあるプラグインをインストールするために利用される可能性があり、結果としてリモートコード実行や権限昇格につながる可能性があります。 🔍 脆弱性の...

CVE-2024-3867

CVE-2024-3867 This repository shows u some information on this vulnerability, which were found by me. Here is the official description given: The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate...

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-87792

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

CVE-2026-87793

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

EUVD-2026-78668

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-87793

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

EUVD-2026-78666

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-87792

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

EUVD-2026-78665

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...