218 matches found
WordPress Petito Theme <= 1.6.2 is vulnerable to Local File Inclusion
Software Petito Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-27362 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 93ad82bdf854 Credits Phat RiO - BlueRock Required privilege Unauthenticat...
WordPress GiftXtore Theme <= 1.7.4 is vulnerable to Local File Inclusion
Software GiftXtore Type Theme Vulnerable versions = 1.7.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28888 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1128d46c2de9 Credits Phat RiO - BlueRock Required privilege...
WordPress Soho Hotel Theme <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)
Software Soho Hotel Type Theme Vulnerable versions = 4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39539 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f1eee5277067 Credits Bonds Required privilege Unauthenticated...
WordPress Lesya Theme <= 1.7.2 is vulnerable to Local File Inclusion
Software Lesya Type Theme Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID b9712c5f2cb9 Credits Bonds Required privilege Unauthenticated Published ...
PT-2025-23567 · WordPress · The Golo - City Travel Guide Wordpress Theme
Name of the Vulnerable Software and Affected Versions: The Golo - City Travel Guide WordPress Theme version 1.7.0 and earlier Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to setting an authorizatio...
WordPress Solar Energy Theme <= 3.5 is vulnerable to PHP Object Injection
Software Solar Energy Type Theme Vulnerable versions = 3.5 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-32283 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 835d026bbefc Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...
WordPress Course Builder Theme < 3.6.6 is vulnerable to PHP Object Injection
Software Course Builder Type Theme Vulnerable versions 3.6.6 Fixed in 3.6.6 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-48336 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 330f3e0387ca Credits Annn Required privilege Unauthenticated...
CVE-2025-31633 WordPress Kiamo - Responsive Business Service WordPress Theme <= 1.3.3 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a throu...
CVE-2024-1357
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auxtimeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as...
CVE-2024-5884
The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tplfeaturedcatid’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2024-5966
The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2024-5867
The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2024-9775
The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2024 due to an incomplete blacklist, insufficient input sanitization, and output escaping. This makes it possible for authenticated...
CVE-2024-4034
The Virtue theme for WordPress is vulnerable to Stored Cross-Site Scripting via a Post Author's name in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping when the latest posts feature is enabled on the homepage. This makes it possible for...
CVE-2024-10847
The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov...
CVE-2024-11926
The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'stPartnerCreateServiceRental', 'stdeleteorderitem', 'stpartnerapprovebooking', 'saveorderitem', and 'userDenyEachInfo' functions in all versions up t...
CVE-2022-2180
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution RCE...
CVE-2021-24321
The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the btbblistingfieldpricerangeto, btbblistingfieldnowopen, btbblistingfieldmylng, listinglistview and btbblistingfieldmylat parameters before using them in a SQL statement, leading to SQL Injection issues...
CVE-2020-36704
The Fruitful Theme for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters stored via the fruitfulthemeoptionsaction AJAX action in versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...