WordPress Themify Newsy theme <= 1.9.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Newsy versions = 1.9.9...

Wordfence Intelligence Weekly WordPress Vulnerability Report (March 3, 2025 to March 9, 2025)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

Wordfence Intelligence Weekly WordPress Vulnerability Report (February 17, 2025 to February 23, 2025)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

WordPress Themes Coder plugin < 1.4.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Project Black in WordPress Plugin Themes Coder versions 1.4.0...

CVE-2020-36708

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely = 1.2.7, NewsMag = 2.4.1, Activello = 1.4.0, Illdy = 2.1.4, Allegiant = 1.2.2, Newspaper X = 1.3.1, Pixova Lite = 2.0.5, Brilliance = 1.2.7, MedZone Lite = 1.2.4, Regina Lite = 2.0.4,...

CVE-2024-56234 WordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through = 2.1...

CVE-2024-51634

CVE-2024-51634 describes a CSRF to Reflected XSS vulnerability in the WordPress plugin Webriti Custom Login (Webriti Shop plugins), affecting versions up to 0.3. The provided documents confirm the issue and its affected range, but do not include a published fix version or concrete remediation ste...

CVE-2022-4974

The connected sources confirm CVE-2022-4974 concerns the Freemius SDK used in WordPress plugins/themes, with a root cause of missing capability checks and nonce protection in the functions _get_debug_log, _get_db_option, and _set_db_option. Versions up to and including 2.4.2 are vulnerable to Cro...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 9, 2024 to September 15, 2024)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024 , r esearchers...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 26, 2024 to September 1, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024, researchers c...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 5, 2024 to August 11, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 14th, researchers can earn up to $31,200, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and ...

WordPress Themes 安全漏洞

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress Themes that stems from insufficient cleaning o...

CVE-2024-34389

Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4...

PT-2024-25849 · Unknown · Wp Post Author

Name of the Vulnerable Software and Affected Versions: WP Post Author versions 3.6.4 and earlier Description: The issue is related to a Missing Authorization vulnerability in AF themes WP Post Author. Recommendations: For WP Post Author versions 3.6.4 and earlier, update to a version that contain...

PT-2024-25847 · Unknown · Wp Post Author

Name of the Vulnerable Software and Affected Versions: WP Post Author versions 3.6.4 and earlier Description: The issue is related to a Missing Authorization vulnerability in AF themes WP Post Author. Recommendations: For WP Post Author versions 3.6.4 and earlier, update to a version that contain...

CVE-2024-33686 Broken Access Control vulnerability affecting multiple WordPress themes by Extend Themes

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea...

CVE-2024-31386

CVE-2024-31386 is a Cross-Site Request Forgery (CSRF) vulnerability affecting a set of WordPress themes/plugins (X-T9, Lightning, Default Mag, Namaha, CityLogic, i-max, Emmet Lite, Decode, Sliding Door, Shopstar!, Gridsby, HappenStance, i-excel, Panoramic, Sensible WP) with listed version ranges ...

CVE-2023-2813

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

CVE-2023-2813

CVE-2023-2813 describes a reflected XSS in multiple WordPress themes (e.g., Aapna, Anand, Anfaust, Arendelle, etc.) up to varying versions (as listed in the description). The issue arises from the search box reflecting results, allowing an unauthenticated attacker to lure users into clicking a ma...

PT-2023-21587 · WordPress · Viburno +47

Name of the Vulnerable Software and Affected Versions: Aapna WordPress theme versions 1.3 and earlier Anand WordPress theme versions 1.2 and earlier Anfaust WordPress theme versions 1.1 and earlier Arendelle WordPress theme versions prior to 1.1.13 Atlast Business WordPress theme versions 1.5.8.5...