Exploit for Missing Authorization in Spicethemes Newsblogger

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Uplo...

CVE-2025-1327 Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion

The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homeydeleteuseraccount' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access...

WordPress Motors Theme <= 5.6.65 is vulnerable to Content Injection

Software Motors Type Theme Vulnerable versions = 5.6.65 Fixed in 5.6.66 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-13738 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 81285145e079 Credits Lucio Sá Required privilege Unauthenticated...

CVE-2025-1304

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsbloggerinstallandactivateplugin function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2025-1304 NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsbloggerinstallandactivateplugin function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2025-1304 NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsbloggerinstallandactivateplugin function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and...

WordPress NewsBlogger theme <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation vulnerability

Cross-Site Request Forgery to Arbitrary Plugin Installation vulnerability discovered by Gibran Abdillah in WordPress Theme NewsBlogger versions = 0.2.5.4...

WordPress NewsBlogger Theme <= 0.2.5.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software NewsBlogger Type Theme Vulnerable versions = 0.2.5.4 Fixed in 0.2.5.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-1305 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 0ec134d8edb7 Credits Gibran Abdillah...

WordPress NewsBlogger Theme <= 0.2.5.1 is vulnerable to Arbitrary File Upload

Software NewsBlogger Type Theme Vulnerable versions = 0.2.5.1 Fixed in 0.2.5.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-1304 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 233ab859c905 Credits CVEhunter Required privilege Subscriber...

CVE-2015-4582

The TheCartPress boot-store aka Boot Store theme 1.6.4 for WordPress allows header.php tcpregistererror XSS. NOTE: CVE-2015-4582 is not assigned to any Oracle product...

CVE-2015-4582

CVE-2015-4582 affects TheCartPress boot-store theme (WordPress) version 1.6.4. The flaw is a cross-site scripting (XSS) vulnerability in header.php via the tcp_register_error function. Public sources in the connected docs identify the affected software and the XSS outcome, but do not provide a co...

CVE-2025-2558

The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server...

WordPress EduMall Theme <= 4.2.4 is vulnerable to Local File Inclusion

Software EduMall Type Theme Vulnerable versions = 4.2.4 Fixed in 4.3.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-2101 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ce27fee25f49 Credits Tonn Required privilege Unauthenticated Published ...

CVE-2025-39359 WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through = 1.3.1...

CVE-2025-39359 WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through = 1.3.1...

CVE-2024-13307

CVE-2024-13307 concerns the Reales WP Real Estate WordPress Theme (versions

CVE-2025-2558

The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server...

CVE-2025-2558 The Wound <= 0.0.1 - Unauthenticated LFI

The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server...

WordPress Vikinger Theme <= 1.9.30 is vulnerable to Privilege Escalation

Software Vikinger Type Theme Vulnerable versions = 1.9.30 Fixed in 1.9.31 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-2238 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 27a6956156c8 Credits Tonn Required...

PT-2025-17707 · WordPress · The Reales Wp

Name of the Vulnerable Software and Affected Versions: The Reales WP - Real Estate WordPress Theme versions up to, and including, 2.1.2 Description: The issue allows unauthorized modification and loss of data due to a missing capability check on the reales delete file, reales delete file plans,...