WordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme Tantyyellow versions = 1.0.0.5...

WordPress my zebra theme <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme my zebra versions = 2.0.6...

CVE-2025-23717 WordPress Theme My Ontraport Smartform plugin <= 1.2.11 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in itmooti Theme My Ontraport Smartform theme-my-ontraport-smartform allows Stored XSS.This issue affects Theme My Ontraport Smartform: from n/a through = 1.2.11...

CVE-2025-0170

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sortby' and 'token' parameters. This makes it possible for unauthenticated attackers to inject...

CVE-2025-0170 DWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sortby' and 'token' parameters. This makes it possible for unauthenticated attackers to inject...

CVE-2025-0170

The CVE-2025-0170 entry documents a Reflected Cross-Site Scripting vulnerability in the DWT - Directory & Listing WordPress Theme (versions up to and including 3.3.3). The root cause is insufficient input sanitization and output escaping on the sort_by and token parameters, enabling unauthenticat...

PT-2025-3759 · WordPress · Dwt - Directory & Listing Wordpress Theme

Name of the Vulnerable Software and Affected Versions: DWT - Directory & Listing WordPress Theme versions up to, and including, 3.3.3 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping on the sort by and token parameters...

CVE-2025-0170: Improper Neutralization of Input During Web Page Generation

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sortby' and 'token' parameters. This makes it possible for unauthenticated attackers to inject...

CVE-2025-22769

CVE-2025-22769 is tied to a Stored XSS in the WordPress plugin Multifox. The connected Red Hat/ENISA/Wordfence entries confirm an authenticated (Contributor+) Stored Cross-Site Scripting issue in Multifox, affecting versions up to 1.3.7 and described as Improper Neutralization of Input During Web...

WordPress my money theme <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme my money versions = 2.0.6...

WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme offset writing versions = 1.2...

WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme Js O3 Lite versions = 1.5.8.2...

CVE-2024-12855

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2025-22334

CVE-2025-22334 describes an stored XSS in the WordPress plugin/theme setup “Education LMS” by FilaThemes. The vulnerability is classified as an improper neutralization of input during web page generation (XSS). Public details indicate the affected scope as Education LMS versions from n/a up to 0....

CVE-2024-12781

The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab1cldemoinstallpackagecontent' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated...

PT-2025-1950 · Aurum · Aurum

Name of the Vulnerable Software and Affected Versions: Aurum - WordPress & WooCommerce Shopping Theme versions prior to 4.0.3 Description: The issue concerns a missing capability check in the lab 1cl demo install package content function, allowing authenticated attackers with Subscriber-level...

WordPress TheFude theme < 1.3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme TheFude - Crowdfunding & Charity WordPress Theme versions 1.3.8...

CVE-2024-38731

CVE-2024-38731 is a CSRF vulnerability in the WordPress theme i-amaze by Marsian, affecting versions up to 1.3.7 (and “n/a through 1.3.7” as stated). The CVSS metrics indicate a network attack vector, no confidentiality impact, and a partial integrity impact with a required user interaction, yiel...

CVE-2024-38731 WordPress i-amaze theme <= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7...

CVE-2024-38732 WordPress Patricia Blog theme <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through 1.2...