CVE-2025-5393 Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the aloneimportpackrestoredata function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated...

CVE-2025-5393

The CVE-2025-5393 entry concerns Alone – Charity Multipurpose Non-profit WordPress Theme. Concrete details from connected docs show: versions up to and including 7.8.3 are affected by missing authorization leading to unauthenticated arbitrary file deletion via alone_import_pack_restore_data(), wi...

PT-2025-29535

Name of the Vulnerable Software and Affected Versions Alone – Charity Multipurpose Non-profit WordPress Theme versions up to and including 7.8.3 Description The Alone – Charity Multipurpose Non-profit WordPress Theme is vulnerable to arbitrary file deletion due to insufficient file path validatio...

WordPress Visual Art | Gallery WordPress Theme Theme <= 2.4 is vulnerable to PHP Object Injection

Software Visual Art | Gallery WordPress Theme Type Theme Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31422 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID f75a5b9fac9b Credits Tran Nguyen Bao Khanh VC...

PT-2025-29536

Name of the Vulnerable Software and Affected Versions Alone – Charity Multipurpose Non-profit WordPress Theme versions 7.8.3 and earlier Description The Alone WordPress theme contains a critical vulnerability that allows unauthenticated attackers to upload malicious files, potentially leading to...

WordPress Alone Theme <= 7.8.2 is vulnerable to Arbitrary File Deletion

Software Alone Type Theme Vulnerable versions = 7.8.2 Fixed in 7.8.5 OWASP Top 10 A1: Injection Classification Arbitrary File Deletion CVE CVE-2025-5393 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 5aa08c886c4e Credits Thái An Required privilege Unauthenticated...

CVE-2025-1313 Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it...

CVE-2025-1313

The CVE-2025-1313 entry concerns Nokri – Job Board WordPress Theme. Connected sources confirm a privilege escalation via account takeover vulnerability affecting versions

CVE-2025-1313 Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it...

PT-2025-29296 · WordPress · The Nokri – Job Board Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Nokri - Job Board WordPress Theme versions prior to 1.6.4 Description: The Nokri - Job Board WordPress Theme is susceptible to privilege escalation, potentially leading to account takeover. The issue stems from insufficient validation of a...

WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Houzez versions = 4.2.5...

WordPress Traveler Theme < 3.2.2 is vulnerable to SQL Injection

Software Traveler Type Theme Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2025-52714 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d97b1d91ed8e Credits Thái An Required privilege Unauthenticated Published 10...

WordPress Uncode Core Cross-Site Scripting Vulnerability

WordPress Uncode Core is a creative multipurpose theme for the WordPress platform. WordPress Uncode Core suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and output escaping, which can be exploited by an attacker to steal user session information by...

WordPress Red Art Code Injection Vulnerability

WordPress Red Art is a theme designed for the art field, mainly used to create artist portfolios, galleries, photography exhibitions, tattoo studios and other art websites. WordPress Red Art suffers from a code injection vulnerability that stems from deserializing untrustworthy data, which can be...

CVE-2025-4606

The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it...

CVE-2025-4606

The CVE-2025-4606 entry concerns the Sala - Startup & SaaS WordPress Theme and its vulnerability to unauthenticated privilege escalation. Affected versions are all up to 1.1.4, where the theme fails to properly validate a user’s identity before updating details such as passwords. This allows an u...

CVE-2025-4606 Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover

The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it...

PT-2025-28838 · Unknown · Sala - Startup & Saas Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Sala - Startup & SaaS WordPress Theme versions prior to 1.1.5 Description: The issue arises from the theme's failure to properly validate a user's identity before updating their details, such as the password. This allows unauthenticated...

WordPress Sala Theme <= 1.1.4 is vulnerable to Privilege Escalation

Software Sala Type Theme Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4606 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID e358e6b6574a Credits Thái An Required...

WordPress Noisa Theme <= 2.6.0 is vulnerable to PHP Object Injection

Software Noisa Type Theme Vulnerable versions = 2.6.0 Fixed in 2.6.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-53560 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 60e4fbd75f25 Credits Bonds Required privilege Subscriber Published 8 Jul...