Spabrice
Monthly
Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.
Basic XSS via arbitrary shortcode execution in the Nyla WordPress theme (versions through 1.7) allows unauthenticated remote attackers to inject script-bearing HTML tags into rendered web pages, resulting in limited confidentiality impact against site visitors. The vulnerability is classified under CWE-80 and was disclosed by Patchstack, who titled the finding 'Arbitrary Shortcode Execution' - indicating that the XSS payload is delivered through unsanitized shortcode rendering rather than a conventional input field. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
SpabRice Mogi theme versions through 1.2.3 fail to properly enforce authorization controls, allowing unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 with low confidentiality impact but no integrity or availability impact. EPSS exploitation probability is minimal at 0.02%, and no public exploit code or active exploitation has been identified.
Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.
Basic XSS via arbitrary shortcode execution in the Nyla WordPress theme (versions through 1.7) allows unauthenticated remote attackers to inject script-bearing HTML tags into rendered web pages, resulting in limited confidentiality impact against site visitors. The vulnerability is classified under CWE-80 and was disclosed by Patchstack, who titled the finding 'Arbitrary Shortcode Execution' - indicating that the XSS payload is delivered through unsanitized shortcode rendering rather than a conventional input field. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
SpabRice Mogi theme versions through 1.2.3 fail to properly enforce authorization controls, allowing unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 with low confidentiality impact but no integrity or availability impact. EPSS exploitation probability is minimal at 0.02%, and no public exploit code or active exploitation has been identified.