Skip to main content

Wordpress Theme CVE-2025-30997

| EUVDEUVD-2025-17237 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2025-06-06 audit@patchstack.com
WordPress SSRF Wordpress Theme
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Mar 14, 2026 - 18:10 euvd
EUVD-2025-17237
Analysis Generated
Mar 14, 2026 - 18:10 vuln.today
CVE Published
Jun 06, 2025 - 13:15 nvd
MEDIUM 5.4

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services allows Server Side Request Forgery. This issue affects Car Repair Services: from n/a through 5.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in SmartDataSoft Car Repair Services WordPress theme up to version 5.0 allows unauthenticated attackers to coerce the server into making arbitrary requests, potentially leading to internal network scanning or data exfiltration. This issue carries a CVSS 5.4 score with changed scope, but exploitation is hindered by high attack complexity. No active exploitation or public exploit code has been identified at time of analysis.

More in Wordpress Theme

View all
CVE-2025-1307 CRITICAL
9.8 Mar 04

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
CVE-2019-25142 HIGH POC
8.8 Jun 07

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
CVE-2023-45657 HIGH
8.5 Nov 06

A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
CVE-2020-36721 MEDIUM POC
6.5 Jun 07

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
CVE-2024-52413 CRITICAL
9.8 Nov 16

Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
CVE-2020-17362 MEDIUM POC
6.1 Aug 12

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
CVE-2025-26927 CRITICAL
10.0 Apr 15

Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
CVE-2026-81779 CRITICAL
10.0 Aug 31

Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
CVE-2025-49071 CRITICAL
10.0 Jun 17

Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo
CVE-2025-30933 CRITICAL
10.0 Jul 04

Remote code execution in LogisticsHub WordPress theme allows unauthenticated attackers to upload arbitrary files, includ
CVE-2025-50002 CRITICAL
10.0 Jan 22

Farost Energia WordPress plugin allows unrestricted file upload enabling attackers to upload web shells and achieve remo
CVE-2025-58963 CRITICAL
10.0 Oct 22

Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

CVE-2025-30997 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy