2678 matches found
EUVD-2025-210579
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2025-14469
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
WordPress Theme Editor plugin <= 3.1 - Cross-Site Request Forgery to CSS Modification vulnerability
Cross-Site Request Forgery to CSS Modification vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Editor versions = 3.1...
PT-2026-66997
Name of the Vulnerable Software and Affected Versions Theme Editor plugin for WordPress versions prior to 3.2 Description The plugin is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to...
EUVD-2026-50115
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423: Improper Control of Generation of Code
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
JobMonster < 4.5.2.9 - Cross-Site Scripting Detection
In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """In the theme JobMonster 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...
CVE-2026-65522
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
EUVD-2026-48124
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65522
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65522 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
EUVD-2026-48117
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511 WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
