CVE-2025-1285

The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the deleteapikey and saveapikey AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to...

CVE-2025-1285

CVE-2025-1285 affects the Resido – Real Estate WordPress Theme. The vulnerability arises from a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to and including 3.6, enabling unauthenticated attackers to issue requests to internal services and updat...

WordPress Civi theme <= 2.1.4 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by Lucio Sá in WordPress Theme Civi versions = 2.1.4...

PT-2025-11237

Name of the Vulnerable Software and Affected Versions: The Resido - Real Estate WordPress Theme versions up to, and including, 3.6 Description: The issue is related to unauthorized access due to a missing capability check on the delete api key and save api key AJAX actions. This allows...

CVE-2024-13773: Use of Hard-coded Cryptographic Key

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including Linked...

PT-2025-11253

Name of the Vulnerable Software and Affected Versions JobCareer | Job Board Responsive WordPress Theme versions up to, and including, 7.1 Description The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due t...

CVE-2025-2289: Missing Authorization

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2024-12810: Missing Authorization

The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, wit...

CVE-2025-0952: Missing Authorization

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmastershideadminnotice' AJAX action in all versions up to, and including, 2.0.4. This mak...

CVE-2024-13771: Authentication Bypass Using an Alternate Path or Channel

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change...

PT-2025-11246

Name of the Vulnerable Software and Affected Versions: The Zegen - Church WordPress Theme versions prior to 1.1.9 Description: The issue is related to unauthorized access due to a missing capability check on several AJAX endpoints. This allows authenticated attackers with Subscriber-level access...

PT-2025-11243

Name of the Vulnerable Software and Affected Versions: The Eco Nature - Environment & Ecology WordPress Theme versions up to, and including, 2.0.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data, potentially leading to a denial of servic...

CVE-2025-1285: Missing Authorization

The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the deleteapikey and saveapikey AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to...

WordPress Top Store Theme 1.5.4 Privilege Escalation Exploit

import requests import argparse import re import json By Nxploit | Khaled Alenazi def disablesslverification: requests.packages.urllib3.disablewarnings session.verify = False Ignore SSL verification def loginurl, username, password: loginurl = f"url/wp-login.php" logindata = "log": username, "pwd...

Exploit for CVE-2024-10674

CVE-2024-10674 Exploit - Th Shop Mania --username --password...

Exploit for CVE-2024-10673

🔥 Overview This script exploits CVE-2024-10673, a critica...

CVE-2024-12876

The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.10. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible fo...

CVE-2024-13655

The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanelofajaxcallback function in all versions up to, and including, 3.5.2. This makes it possible f...

CVE-2025-0749

The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verificationid' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers t...

CVE-2024-13787

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'vedabackupandrestoreaction' function. This makes it possible for authenticated attackers, with Subscriber-leve...