CVE-2024-13786 Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerexcallbackviewmoreposts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

CVE-2024-13786 Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerexcallbackviewmoreposts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...

WordPress Alone Theme <= 7.8.2 is vulnerable to Arbitrary Code Execution

Software Alone Type Theme Vulnerable versions = 7.8.2 Fixed in 7.8.5 OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2025-52718 Patch priority High CVSS severity High 7.2 Developer Claim ownership PSID 95e1c49b307c Credits Trương Hữu Phúc truonghuuphuc Required privileg...

WordPress Houzez Theme <= 4.0.4 is vulnerable to Local File Inclusion

Software Houzez Type Theme Vulnerable versions = 4.0.4 Fixed in 4.0.8 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-53198 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID d9a95839ea4d Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Home Villas Theme <= 2.8 is vulnerable to Arbitrary File Deletion

Software Home Villas Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Deletion CVE CVE-2025-5014 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID cba250cec63a Credits Thái An Required privilege Subscriber Published...

WordPress CouponXxL Theme <= 3.0.0 is vulnerable to PHP Object Injection

Software CouponXxL Type Theme Vulnerable versions = 3.0.0 Fixed in 3.1.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-52725 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 04cffe8dee73 Credits Bonds Required privilege Unauthenticated...

CVE-2024-12827

The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the...

CVE-2025-52729 WordPress Diza theme <= 1.3.9 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Diza allows PHP Local File Inclusion. This issue affects Diza: from n/a through 1.3.9...

CVE-2025-52812 WordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ApusWP Domnoo allows PHP Local File Inclusion. This issue affects Domnoo: from n/a through 1.49...

CVE-2024-12827

The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the...

WordPress Constructor Theme <= 1.6.5 is vulnerable to Broken Access Control

Software Constructor Type Theme Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-53302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 616342014c3c Credits Sulabh Jain Required privilege...

WordPress Zenny Theme <= 1.7.5 is vulnerable to Local File Inclusion

Software Zenny Type Theme Vulnerable versions = 1.7.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24769 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 2ee43f510f3c Credits Phat RiO - BlueRock Required privilege Unauthenticate...

WordPress Zita Theme <= 1.6.5 is vulnerable to Local File Inclusion

Software Zita Type Theme Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-52816 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 948a42c80224 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Requir...

WordPress Puca Theme <= 2.6.33 is vulnerable to Local File Inclusion

Software Puca Type Theme Vulnerable versions = 2.6.33 Fixed in 2.6.34 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-30992 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 5c9cf9e5fa07 Credits Phat RiO - BlueRock Required privilege...

WordPress Seven Stars Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Seven Stars Type Theme Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31067 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9c2cf87e3798 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

WordPress Sofass Theme <= 1.3.4 is vulnerable to Local File Inclusion

Software Sofass Type Theme Vulnerable versions = 1.3.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24760 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 97dd93e076df Credits Phat RiO - BlueRock Required privilege Unauthenticat...

WordPress CozyStay Theme < 1.7.1 is vulnerable to Local File Inclusion

Software CozyStay Type Theme Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49508 Patch priority High CVSS severity High 8.1 Developer LoftOcean PSID 0ccb72a10659 Credits Bonds Required privilege Unauthenticated Published 11...

WordPress Maia Theme <= 1.1.15 is vulnerable to Local File Inclusion

Software Maia Type Theme Vulnerable versions = 1.1.15 Fixed in 1.1.16 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-49258 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 17919a5d64c7 Credits Phat RiO - BlueRock Required privilege...

WordPress Spare Theme <= 1.7 is vulnerable to PHP Object Injection

Software Spare Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31919 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 56b785ef822a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4601 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08bda80a3ca8 Credits Thái An Require...