WordPress Theme Duplicator Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Abdi Pranata in WordPress Plugin Theme Duplicator versions = 1.1...

CVE-2025-31845

CVE-2025-31845 shows a Cross-Site Request Forgery (CSRF) in the Theme Duplicator plugin, affecting versions up to 1.1. The provided documents do not include concrete technical details (vectors, root cause, exploitation, or remediation). Monitor for updates and official advisories for further spec...

CVE-2025-31845 WordPress Theme Duplicator Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rohit Choudhary Theme Duplicator allows Cross Site Request Forgery. This issue affects Theme Duplicator: from n/a through 1.1...

WordPress Themify Sidepane WordPress Theme <=1.9.8 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Sidepane WordPress Theme versions = 1.9.8...

WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Folo versions = 1.9.6...

CVE-2025-2891

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and abov...

CVE-2025-2891 WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and abov...

CVE-2025-2891 WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and abov...

CVE-2025-2891

CVE-2025-2891 – Real Estate 7 WordPress Theme : The vulnerability is in the Real Estate 7 WordPress Theme for WordPress, allowing authenticated attackers with Seller-level access (and above) to upload arbitrary files due to missing file type validation in template-submit-listing.php. Affected ver...

WordPress Rezo Theme <= 1.9.7 is vulnerable to Cross Site Scripting (XSS)

Software Rezo Type Theme Vulnerable versions = 1.9.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31013 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c43544fe3a66 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunit...

PT-2025-14088 · WordPress · The Real Estate 7

Name of the Vulnerable Software and Affected Versions: Real Estate 7 WordPress theme versions up to, and including, 3.5.4 Description: The Real Estate 7 WordPress theme is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file. This mak...

WordPress Themify Sidepane WordPress theme <=1.9.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Sidepane WordPress Theme versions = 1.9.8...

WordPress Newscrunch Theme 1.8.4.1 Shell Upload

WordPress Newscrunch theme version 1.8.4.1 suffers from a remote shell upload vulnerability...

WordPress Themify Sidepane WordPress Theme Theme <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)

Software Themify Sidepane WordPress Theme Type Theme Vulnerable versions = 1.9.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31013 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID ae3543e5888e Credits Tran Nguyen Bao Khanh VC...

CVE-2025-2804 tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'accountid' and 'accountusername' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2025-22770 WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6...

CVE-2025-22770 WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6...

CVE-2025-22816 WordPress Power Mag theme <= 1.1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeTrendy Power Mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through 1.1.5...

CVE-2025-26736 WordPress MorningTime Lite theme <= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in victortihai MorningTime Lite morningtime-lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through = 1.3.2...

CVE-2025-26736 WordPress MorningTime Lite theme <= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in victortihai MorningTime Lite morningtime-lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through = 1.3.2...