Thememove
Monthly
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
Local file inclusion in the Atomlab WordPress theme versions 2.4.5 and earlier allows remote unauthenticated attackers to include arbitrary PHP files on the server, potentially leading to sensitive information disclosure and remote code execution. The flaw is tracked under CWE-98 (improper control of filename for include/require) and carries a CVSS 3.1 base score of 8.1 (high). No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.
SQL injection in the Unicamp WordPress theme (versions 2.2.2 and earlier) by ThemeMove allows an attacker holding a low-privilege Subscriber account to inject arbitrary SQL into backend database queries. Because the CVSS scope is marked changed with high confidentiality impact, a successful attacker can read data beyond their normal authorization boundary, including other users' records and potentially credentials stored in the WordPress database. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Mitech WordPress theme (through 2.3.4) allows PHP Local File Inclusion through improper filename control in include/require statements.
Moody WordPress theme (through 2.7.3) allows PHP Local File Inclusion through improper filename control.
Brook WordPress theme (through 2.8.9) allows PHP Local File Inclusion via improper filename control in PHP include statements.
AeroLand WordPress theme (through 1.6.6) allows PHP Local File Inclusion through improper filename control. Unauthenticated RCE possible via include chain.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in ThemeMove MinimogWP through 3.9.6 lets authenticated low-privilege WordPress users influence a PHP include/require statement (CWE-98), potentially disclosing sensitive local files or, if a local PHP-parseable file can be targeted, escalating to code execution. The flaw is network-reachable but high complexity (AC:H) because success depends on path, wrapper, or target-file conditions the attacker does not fully control; it requires a low-privileged authenticated account (PR:L), needs no user interaction (UI:N), and carries a vendor CVSS base score of 7.5. No public exploit identified at time of analysis.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Unauthenticated remote attackers can trigger PHP local file inclusion in the ThemeMove EduMall WordPress theme on any version below 4.4.5, because a filename passed to an include/require statement is not properly controlled. Successful exploitation is rated high complexity, so the practical risk depends on reaching the specific vulnerable parameter and, for code execution rather than disclosure, on the attacker being able to plant PHP content in an includable path - those trigger conditions are not disclosed in the available advisory. There is no public exploit code identified at time of analysis and no CISA KEV listing; EPSS is 0.53% (43rd percentile), indicating a low-to-moderate exploitation likelihood, and the vendor fix is EduMall 4.4.5.
Local file inclusion in the ThemeMove Billey WordPress theme (all versions from initial release through 2.1.5) allows unauthenticated remote attackers to pass attacker-influenced input into a PHP include/require statement, enabling disclosure of local files on the web server and, where an includable attacker-controlled file is reachable on the host, escalation to code execution. The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but also a non-trivial precondition that limits reliable exploitation, while EPSS is low at 0.53% (43rd percentile) and no public exploit identified at time of analysis. Sites running Billey 2.1.6 or later are not affected.
Local file inclusion in the ThemeMove Medizin WordPress theme (all versions before 1.9.7) allows unauthenticated remote attackers to steer a filename/path value into a PHP include/require statement, exposing local files and potentially enabling code execution if the attacker can influence an includable file or an enabled PHP wrapper. The CVSS 3.1 vector is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): exploitation is network-reachable and requires no authentication or user interaction, but the high attack complexity reflects that the exact vulnerable parameter/endpoint is not publicly documented and success depends on prerequisites such as a reachable injection point or an enabled wrapper. No public exploit has been identified at time of analysis, EPSS is low at 0.53% (43rd percentile), and there is no CISA KEV listing, making this a genuine but mid-tier priority for sites running the theme actively.
Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.
Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach allows PHP Local File Inclusion.2.5. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in ThemeMove Makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.8.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp allows PHP Local File Inclusion.6.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic allows PHP Local File Inclusion.8.4. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
SQL injection in ThemeMove Amely WordPress theme (≤3.1.4) allows unauthenticated remote attackers to extract sensitive database data via crafted SQL queries. The vulnerability is network-exploitable with no user interaction, presenting a severe risk to sites using the theme. No public exploit or active exploitation has been confirmed at this time.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul allows PHP Local File Inclusion.0.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
Local file inclusion in the Atomlab WordPress theme versions 2.4.5 and earlier allows remote unauthenticated attackers to include arbitrary PHP files on the server, potentially leading to sensitive information disclosure and remote code execution. The flaw is tracked under CWE-98 (improper control of filename for include/require) and carries a CVSS 3.1 base score of 8.1 (high). No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.
SQL injection in the Unicamp WordPress theme (versions 2.2.2 and earlier) by ThemeMove allows an attacker holding a low-privilege Subscriber account to inject arbitrary SQL into backend database queries. Because the CVSS scope is marked changed with high confidentiality impact, a successful attacker can read data beyond their normal authorization boundary, including other users' records and potentially credentials stored in the WordPress database. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Mitech WordPress theme (through 2.3.4) allows PHP Local File Inclusion through improper filename control in include/require statements.
Moody WordPress theme (through 2.7.3) allows PHP Local File Inclusion through improper filename control.
Brook WordPress theme (through 2.8.9) allows PHP Local File Inclusion via improper filename control in PHP include statements.
AeroLand WordPress theme (through 1.6.6) allows PHP Local File Inclusion through improper filename control. Unauthenticated RCE possible via include chain.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in ThemeMove MinimogWP through 3.9.6 lets authenticated low-privilege WordPress users influence a PHP include/require statement (CWE-98), potentially disclosing sensitive local files or, if a local PHP-parseable file can be targeted, escalating to code execution. The flaw is network-reachable but high complexity (AC:H) because success depends on path, wrapper, or target-file conditions the attacker does not fully control; it requires a low-privileged authenticated account (PR:L), needs no user interaction (UI:N), and carries a vendor CVSS base score of 7.5. No public exploit identified at time of analysis.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Unauthenticated remote attackers can trigger PHP local file inclusion in the ThemeMove EduMall WordPress theme on any version below 4.4.5, because a filename passed to an include/require statement is not properly controlled. Successful exploitation is rated high complexity, so the practical risk depends on reaching the specific vulnerable parameter and, for code execution rather than disclosure, on the attacker being able to plant PHP content in an includable path - those trigger conditions are not disclosed in the available advisory. There is no public exploit code identified at time of analysis and no CISA KEV listing; EPSS is 0.53% (43rd percentile), indicating a low-to-moderate exploitation likelihood, and the vendor fix is EduMall 4.4.5.
Local file inclusion in the ThemeMove Billey WordPress theme (all versions from initial release through 2.1.5) allows unauthenticated remote attackers to pass attacker-influenced input into a PHP include/require statement, enabling disclosure of local files on the web server and, where an includable attacker-controlled file is reachable on the host, escalation to code execution. The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but also a non-trivial precondition that limits reliable exploitation, while EPSS is low at 0.53% (43rd percentile) and no public exploit identified at time of analysis. Sites running Billey 2.1.6 or later are not affected.
Local file inclusion in the ThemeMove Medizin WordPress theme (all versions before 1.9.7) allows unauthenticated remote attackers to steer a filename/path value into a PHP include/require statement, exposing local files and potentially enabling code execution if the attacker can influence an includable file or an enabled PHP wrapper. The CVSS 3.1 vector is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): exploitation is network-reachable and requires no authentication or user interaction, but the high attack complexity reflects that the exact vulnerable parameter/endpoint is not publicly documented and success depends on prerequisites such as a reachable injection point or an enabled wrapper. No public exploit has been identified at time of analysis, EPSS is low at 0.53% (43rd percentile), and there is no CISA KEV listing, making this a genuine but mid-tier priority for sites running the theme actively.
Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.
Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach allows PHP Local File Inclusion.2.5. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in ThemeMove Makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.8.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp allows PHP Local File Inclusion.6.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic allows PHP Local File Inclusion.8.4. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
SQL injection in ThemeMove Amely WordPress theme (≤3.1.4) allows unauthenticated remote attackers to extract sensitive database data via crafted SQL queries. The vulnerability is network-exploitable with no user interaction, presenting a severe risk to sites using the theme. No public exploit or active exploitation has been confirmed at this time.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul allows PHP Local File Inclusion.0.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.