CVE-2011-3863

Cross-site scripting XSS vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

WordPress Healsoul Theme <= 2.2.0 is vulnerable to Local File Inclusion

Software Healsoul Type Theme Vulnerable versions = 2.2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-32309 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 703f0a241625 Credits Bonds Required privilege Unauthenticated Published...

WordPress Car Dealer Theme <= 1.6.6 is vulnerable to PHP Object Injection

Software Car Dealer Type Theme Vulnerable versions = 1.6.6 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39480 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 4311ea0cfd5b Credits Bonds Required privilege Unauthenticated Publish...

CVE-2025-4524

The CVE-2025-4524 entry concerns the Madara – Responsive and modern WordPress theme for manga sites. A Local File Inclusion exists in all versions up to 2.2.2 via the template parameter, allowing unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially bypas...

WordPress Ruizarch Theme <= 1.1.0 is vulnerable to Local File Inclusion

Software Ruizarch Type Theme Vulnerable versions = 1.1.0 Fixed in 1.2.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID a39d5d2adb6a Credits Bonds Required privilege Unauthenticated Publish...

WordPress Luique Theme <= 1.3.0 is vulnerable to Local File Inclusion

Software Luique Type Theme Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 5a9a2f9ed771 Credits Bonds Required privilege Unauthenticated Published...

WordPress Fish House Theme <= 1.2.7 is vulnerable to PHP Object Injection

Software Fish House Type Theme Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31631 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID db73d8c2822e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Pet World Theme <= 2.8 is vulnerable to PHP Object Injection

Software Pet World Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-32284 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID e46bfa7f1a9a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Larson Theme <= 1.5.0 is vulnerable to Local File Inclusion

Software Larson Type Theme Vulnerable versions = 1.5.0 Fixed in 1.6.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 39f82de60a1f Credits Bonds Required privilege Unauthenticated Published...

WordPress Kinsley Theme <= 3.4.4 is vulnerable to Local File Inclusion

Software Kinsley Type Theme Vulnerable versions = 3.4.4 Fixed in 3.4.5 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID f998fc448b70 Credits Bonds Required privilege Unauthenticated Publishe...

PT-2025-22325

Name of the Vulnerable Software and Affected Versions Madara – Responsive and modern WordPress theme for manga sites versions 2.2.2 and earlier Description The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the template parameter, making it possibl...

WordPress Crafts & Arts Theme <= 2.5 is vulnerable to PHP Object Injection

Software Crafts & Arts Type Theme Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31924 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID c2b3d2de486e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-39366 WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0...

CVE-2025-39351

CVE-2025-39351: Cross-Site Request Forgery in Grand Restaurant WordPress theme (versions &lt;= 7.0). Affects WordPress Grand Restaurant theme; CSRF vulnerability reported with unauthenticated access and potential for unauthorized actions as described in Patchstack/Red Hat/NVD entries. The Patchst...

WordPress HotStar – Multi-Purpose Business Theme Theme <= 1.4 is vulnerable to PHP Object Injection

Software HotStar – Multi-Purpose Business Theme Type Theme Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31069 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5302a6861163 Credits Tran Nguyen Bao Khanh...

WordPress The Business Theme <= 1.6.1 is vulnerable to PHP Object Injection

Software The Business Type Theme Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31430 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 6b1df0573f1a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunit...

PT-2025-18937 · WordPress · The Motors – Car Dealer

Name of the Vulnerable Software and Affected Versions: The Motors - Car Dealer, Rental & Listing WordPress theme versions up to, and including, 5.6.65 Description: The issue is related to arbitrary shortcode execution due to improper validation of a value before running do shortcode, allowing...

WordPress Motors Theme <= 5.6.65 is vulnerable to Content Injection

Software Motors Type Theme Vulnerable versions = 5.6.65 Fixed in 5.6.66 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-13738 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 81285145e079 Credits Lucio Sá Required privilege Unauthenticated...

WordPress NewsBlogger Theme <= 0.2.5.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software NewsBlogger Type Theme Vulnerable versions = 0.2.5.4 Fixed in 0.2.5.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-1305 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 0ec134d8edb7 Credits Gibran Abdillah...

CVE-2025-39359 WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through = 1.3.1...