WordPress Blogprise Theme <= 1.0.9 is vulnerable to Local File Inclusion

Software Blogprise Type Theme Vulnerable versions = 1.0.9 Fixed in 1.0.10 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49277 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1df18a126279 Credits Le Ngoc Anh Required privilege Unauthenticated...

WordPress Blogty Theme <= 1.0.11 is vulnerable to Local File Inclusion

Software Blogty Type Theme Vulnerable versions = 1.0.11 Fixed in 1.0.12 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49278 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 52a382e787f1 Credits Le Ngoc Anh Required privilege Unauthenticated...

WordPress Blogmine Theme <= 1.1.7 is vulnerable to Local File Inclusion

Software Blogmine Type Theme Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49276 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 779447fb763e Credits Le Ngoc Anh Required privilege Unauthenticated...

WordPress Litho Theme <= 3.0 is vulnerable to Arbitrary File Deletion

Software Litho Type Theme Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2025-49879 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID b5c6a3b3bdf8 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Sofass versions = 1.3.4...

WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Zita versions = 1.6.5...

WordPress MBStore - Digital WooCommerce WordPress Theme Theme <= 2.3 is vulnerable to Local File Inclusion

Software MBStore - Digital WooCommerce WordPress Theme Type Theme Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28947 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID a5b961e153f3 Credits Tran Nguyen Bao...

WordPress Zenny Theme <= 1.7.5 is vulnerable to Local File Inclusion

Software Zenny Type Theme Vulnerable versions = 1.7.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24769 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 2ee43f510f3c Credits Phat RiO - BlueRock Required privilege Unauthenticate...

WordPress Zita Theme <= 1.6.5 is vulnerable to Local File Inclusion

Software Zita Type Theme Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-52816 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 948a42c80224 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Requir...

WordPress Seven Stars Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Seven Stars Type Theme Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31067 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9c2cf87e3798 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

WordPress Sofass Theme <= 1.3.4 is vulnerable to Local File Inclusion

Software Sofass Type Theme Vulnerable versions = 1.3.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24760 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 97dd93e076df Credits Phat RiO - BlueRock Required privilege Unauthenticat...

WordPress Puca Theme <= 2.6.33 is vulnerable to Local File Inclusion

Software Puca Type Theme Vulnerable versions = 2.6.33 Fixed in 2.6.34 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-30992 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 5c9cf9e5fa07 Credits Phat RiO - BlueRock Required privilege...

CVE-2025-49970 WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hello FSE Blog: from n/a through 1.0.6...

CVE-2025-50033 WordPress Fitness Park theme <= 1.1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through = 1.1.1...

CVE-2025-50030

CVE-2025-50030 corresponds to a DOM-Based XSS in the Spark Multipurpose WordPress theme (Sparkle Themes). Public details confirm improper input neutralization during web page generation, affecting Spark Multipurpose versions up to 1.0.7 (no fixed version listed). Reported CVSS v3.1 vector yields ...

WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Peter Thaleikis in WordPress Theme Hello FSE Blog versions = 1.0.6...

WordPress Fitness Park Theme <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Fitness Park Type Theme Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-50033 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f81317695731 Credits Peter Thaleikis Required privilege Contribut...

WordPress Hello FSE Blog Theme <= 1.0.6 is vulnerable to Broken Access Control

Software Hello FSE Blog Type Theme Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-49970 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 248511ebb594 Credits Peter Thaleikis Required privileg...

WordPress HYDRO Theme <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software HYDRO Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31428 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d4b1bd6f0305 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-4200

The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...