Mvpthemes
Monthly
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
This is a missing authorization vulnerability (CWE-862) in MVPThemes The League WordPress theme affecting versions up to 4.4.1, where incorrectly configured access control security levels allow attackers to bypass authentication mechanisms. An attacker can exploit this broken access control to perform unauthorized actions or access restricted functionality without proper credentials. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15732, indicating active tracking by EU vulnerability databases.
The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
This is a missing authorization vulnerability (CWE-862) in MVPThemes The League WordPress theme affecting versions up to 4.4.1, where incorrectly configured access control security levels allow attackers to bypass authentication mechanisms. An attacker can exploit this broken access control to perform unauthorized actions or access restricted functionality without proper credentials. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15732, indicating active tracking by EU vulnerability databases.
The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.