CVE-2024-51634

CVE-2024-51634 describes a CSRF to Reflected XSS vulnerability in the WordPress plugin Webriti Custom Login (Webriti Shop plugins), affecting versions up to 0.3. The provided documents confirm the issue and its affected range, but do not include a published fix version or concrete remediation ste...

CVE-2022-4974

The connected sources confirm CVE-2022-4974 concerns the Freemius SDK used in WordPress plugins/themes, with a root cause of missing capability checks and nonce protection in the functions _get_debug_log, _get_db_option, and _set_db_option. Versions up to and including 2.4.2 are vulnerable to Cro...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 9, 2024 to September 15, 2024)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024 , r esearchers...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 26, 2024 to September 1, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024, researchers c...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 5, 2024 to August 11, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 14th, researchers can earn up to $31,200, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and ...

WordPress Themes 安全漏洞

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress Themes that stems from insufficient cleaning o...

CVE-2024-34389

Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4...

PT-2024-25849 · Unknown · Wp Post Author

Name of the Vulnerable Software and Affected Versions: WP Post Author versions 3.6.4 and earlier Description: The issue is related to a Missing Authorization vulnerability in AF themes WP Post Author. Recommendations: For WP Post Author versions 3.6.4 and earlier, update to a version that contain...

PT-2024-25847 · Unknown · Wp Post Author

Name of the Vulnerable Software and Affected Versions: WP Post Author versions 3.6.4 and earlier Description: The issue is related to a Missing Authorization vulnerability in AF themes WP Post Author. Recommendations: For WP Post Author versions 3.6.4 and earlier, update to a version that contain...

CVE-2024-33686 Broken Access Control vulnerability affecting multiple WordPress themes by Extend Themes

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea...

CVE-2024-31386

CVE-2024-31386 is a Cross-Site Request Forgery (CSRF) vulnerability affecting a set of WordPress themes/plugins (X-T9, Lightning, Default Mag, Namaha, CityLogic, i-max, Emmet Lite, Decode, Sliding Door, Shopstar!, Gridsby, HappenStance, i-excel, Panoramic, Sensible WP) with listed version ranges ...

CVE-2023-2813

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

CVE-2023-2813

CVE-2023-2813 describes a reflected XSS in multiple WordPress themes (e.g., Aapna, Anand, Anfaust, Arendelle, etc.) up to varying versions (as listed in the description). The issue arises from the search box reflecting results, allowing an unauthenticated attacker to lure users into clicking a ma...

PT-2023-21587 · WordPress · Viburno +47

Name of the Vulnerable Software and Affected Versions: Aapna WordPress theme versions 1.3 and earlier Anand WordPress theme versions 1.2 and earlier Anfaust WordPress theme versions 1.1 and earlier Arendelle WordPress theme versions prior to 1.1.13 Atlast Business WordPress theme versions 1.5.8.5...

WordPress Multi Themes Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-3708

Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 3, 2023 to July 9, 2023)

Last week, there were 61 vulnerabilities disclosed in 54 WordPress Plugins and 1 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 28 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities i...

CVE-2020-36721

The Brilliance = 1.2.7, Activello = 1.4.0, and Newspaper X = 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activelloactivateplugin' and 'activellodeactivateplugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing...

CVE-2020-36708

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely = 1.2.7, NewsMag = 2.4.1, Activello = 1.4.0, Illdy = 2.1.4, Allegiant = 1.2.2, Newspaper X = 1.3.1, Pixova Lite = 2.0.5, Brilliance = 1.2.7, MedZone Lite = 1.2.4, Regina Lite = 2.0.4,...

CVE-2019-25142

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 Mesmerize and 1.0.172 Materialis. This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function...