CVE-2025-31429 WordPress PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1...

CVE-2025-32305 WordPress FlatNews theme <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sneeit FlatNews allows Reflected XSS. This issue affects FlatNews: from n/a through 5.8...

WordPress Fitrush theme <= 1.3.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Fitrush versions = 1.3.4...

WordPress Petito Theme <= 1.6.2 is vulnerable to Local File Inclusion

Software Petito Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-27362 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 93ad82bdf854 Credits Phat RiO - BlueRock Required privilege Unauthenticat...

WordPress TinySalt Theme < 3.10.0 is vulnerable to Local File Inclusion

Software TinySalt Type Theme Vulnerable versions 3.10.0 Fixed in 3.10.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49454 Patch priority High CVSS severity High 8.1 Developer LoftOcean PSID f11131feed0e Credits Bonds Required privilege Unauthenticated Published 9...

WordPress SNS Anton Theme <= 4.1 is vulnerable to Local File Inclusion

Software SNS Anton Type Theme Vulnerable versions = 4.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28992 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1a79e587467e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Nitan Theme <= 2.9 is vulnerable to Local File Inclusion

Software Nitan Type Theme Vulnerable versions = 2.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24768 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ec6d95e09a1c Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...

WordPress MediClinic Theme <= 2.1 is vulnerable to Local File Inclusion

Software MediClinic Type Theme Vulnerable versions = 2.1 Fixed in 2.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49295 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 856af99d1029 Credits Bonds Required privilege Unauthenticated Published...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4601 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08bda80a3ca8 Credits Thái An Require...

PT-2025-24482 · WordPress · Flap - Business Wordpress Theme

Name of the Vulnerable Software and Affected Versions: FLAP - Business WordPress Theme versions 1.5 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, although specific details about the estimated...

WordPress TinySalt Theme < 3.10.0 is vulnerable to PHP Object Injection

Software TinySalt Type Theme Vulnerable versions 3.10.0 Fixed in 3.10.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-49455 Patch priority High CVSS severity High 9.8 Developer LoftOcean PSID 832baca8d9fd Credits Bonds Required privilege Unauthenticated Published 9...

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme Theme <= 2.4 is vulnerable to Local File Inclusion

Software BodyCenter - Gym, Fitness WooCommerce WordPress Theme Type Theme Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2023-25999 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 7c5537e9d6c0 Credits Tran...

WordPress Grill and Chow Theme <= 1.6 is vulnerable to Local File Inclusion

Software Grill and Chow Type Theme Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49297 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 10cea538663d Credits Bonds Required privilege Unauthenticated...

WordPress GiftXtore Theme <= 1.7.4 is vulnerable to Local File Inclusion

Software GiftXtore Type Theme Vulnerable versions = 1.7.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28888 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1128d46c2de9 Credits Phat RiO - BlueRock Required privilege...

CVE-2025-47584 WordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2...

CVE-2025-4797

The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it...

WordPress Car Repair Services theme <= 5.0 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Bonds in WordPress Theme Car Repair Services versions = 5.0...

WordPress Car Repair Services Theme <= 5.0 is vulnerable to Server Side Request Forgery (SSRF)

Software Car Repair Services Type Theme Vulnerable versions = 5.0 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Server Side Request Forgery SSRF CVE CVE-2025-30997 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ac927e58431a Credits Bonds Required privilege...

WordPress Soho Hotel Theme <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Soho Hotel Type Theme Vulnerable versions = 4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39539 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f1eee5277067 Credits Bonds Required privilege Unauthenticated...

CVE-2025-4797

The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it...