PT-2025-17690

Name of the Vulnerable Software and Affected Versions The-wound WordPress theme version 0.0.1 Description The issue concerns the failure to validate certain parameters before using them to generate paths passed to include functions, allowing unauthenticated users to perform Local File Inclusion L...

CVE-2024-13307: Missing Authorization

The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'realesdeletefile', 'realesdeletefileplans', 'realesaddtofavourites', and 'realesremovefromfavourites' functions in all versions up...

WordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Theme Switcha versions = 3.4...

CVE-2025-46239

CVE-2025-46239 affects Theme Switcha (WordPress plugin) up to version 3.4. It is a Stored XSS caused by improper input neutralization during web page generation. The impact is that malicious input could execute scripts in users’ browsers when viewing affected pages. Mitigation: update to a versio...

WordPress wProject Theme < 5.8.0 is vulnerable to Cross Site Scripting (XSS)

Software wProject Type Theme Vulnerable versions 5.8.0 Fixed in 5.8.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39365 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d25ce780039c Credits Dave Jong Patchstack Required privilege...

WordPress plugin Theme Switcha has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue Theme <= 4.2.2 is vulnerable to Broken Access Control

Software Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue Type Theme Vulnerable versions = 4.2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-39398 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Theme CWW Portfolio versions = 1.3.1...

WordPress Arrival Theme <= 1.4.5 is vulnerable to Local File Inclusion

Software Arrival Type Theme Vulnerable versions = 1.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-32921 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 8025063985d8 Credits Dimas Maulana Required privilege Unauthenticated...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to Arbitrary Content Deletion

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2025-39352 Patch priority High CVSS severity High 8.2 Developer EPC PSID e23a34ecdc50 Credits Ananda Dhakal Patchstack...

WordPress CWW Portfolio Theme <= 1.3.1 is vulnerable to Local File Inclusion

Software CWW Portfolio Type Theme Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39359 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID ee2d399fdc37 Credits Dimas Maulana Required privilege...

WordPress Grace Mag Theme <= 1.1.5 is vulnerable to Local File Inclusion

Software Grace Mag Type Theme Vulnerable versions = 1.1.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39360 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 0975a9499751 Credits Dimas Maulana Required privilege Unauthenticated...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to Path Traversal

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2025-32926 Patch priority High CVSS severity High 9.8 Developer EPC PSID f6387809886f Credits Ananda Dhakal Patchstack Required...

WordPress Opstore Theme <= 1.4.5 is vulnerable to Local File Inclusion

Software Opstore Type Theme Vulnerable versions = 1.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39387 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID e65604397b41 Credits Dimas Maulana Required privilege Unauthenticated...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to PHP Object Injection

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39348 Patch priority High CVSS severity High 9.8 Developer EPC PSID c0bb2279949a Credits Ananda Dhakal Patchstack Required privilege...

CVE-2025-1093 AIHub <= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_image

The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generateimage function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which m...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to Broken Access Control

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-39353 Patch priority Low CVSS severity Low 5.3 Developer EPC PSID ef329deabf36 Credits Ananda Dhakal Patchstack Required...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-39351 Patch priority Low CVSS severity Low 4.3 Developer EPC PSID 9bd944eaa16b Credits Ananda Dhakal Patchstack...

CVE-2025-27283 WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Path Traversal.This issue affects Theme File Duplicator: from n/a through = 1.3...

CVE-2025-27282 WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Using Malicious Files.This issue affects Theme File Duplicator: from n/a through = 1.3...