Wordpress Theme
Monthly
Unauthenticated local file inclusion in the Jack Well WordPress theme (<=1.0.14) allows remote attackers to read arbitrary files or execute PHP code on the server via manipulated file paths. The vulnerability carries a CVSS 8.1 score but a low EPSS exploitation probability (0.08%); no active exploitation or public exploit is known at this time.
Local file inclusion in the AncoraThemes Ludos Paradise WordPress theme up to version 2.1.3 permits unauthenticated remote attackers to include arbitrary local files, exposing sensitive server data such as configuration files or credentials. The vulnerability is not known to be actively exploited, and no public exploit code is available. Despite a high CVSS rating, the low EPSS probability and high attack complexity suggest a limited real-world risk.
Local file inclusion in the Kings & Queens WordPress theme by AncoraThemes (through version 1.1.16) enables unauthenticated attackers
Unauthenticated local file inclusion in the Gracioza WordPress theme versions up to 1.0.15 lets remote attackers read arbitrary files and potentially execute code. The flaw stems from improper sanitization of filenames used in include statements (CWE-98). No known public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.
Local file inclusion in Militarology WordPress theme versions up to 1.0.15 allows unauthenticated remote attackers to include arbitrary local files, potentially exposing sensitive data and achieving remote code execution. The vulnerability carries a CVSS 3.1 score of 8.1 (high) but EPSS exploitation probability is low (0.08%), with no public exploit or active exploitation reported.
Local file inclusion in AncoraThemes ShieldGroup WordPress theme versions up to 2.13 enables unauthenticated remote attackers to include arbitrary local files. Despite high CVSS severity, EPSS indicates very low real-world exploitation probability; no active exploitation or public exploit code has been identified at time of analysis.
Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Server-side request forgery in LMPixels Kerge WordPress theme 4.1.3 and earlier allows unauthenticated attackers to coerce the theme into making server-side requests to arbitrary destinations. Successful exploitation can lead to limited information disclosure or interaction with internal services. No active exploitation or public exploit code is currently known, and the EPSS probability is very low (0.05%), suggesting a low immediate risk.
Broken access control in ThemeFusion Avada WordPress theme through version 7.13.2 allows authenticated attackers with low privileges to access functionality improperly constrained by access control lists, potentially achieving full site compromise. With CVSS 8.8 (High) due to network-based access requiring only low-privilege authentication, attackers can achieve high confidentiality, integrity, and availability impact. EPSS probability remains low at 0.06% (18th percentile), and no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite the critical CVSS rating.
Local file inclusion in the Hara WordPress theme (versions <= 1.2.17) allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure, code execution via PHP file inclusion chains, or full site takeover. The attack requires high complexity, and no exploit code or active exploitation has been publicly identified at the time of analysis.
Local File Inclusion vulnerability in the Turitor WordPress theme before version 1.5.3 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to information disclosure, code execution, or denial of service. No public exploit or active exploitation known at this time.
Local file inclusion vulnerability in thembay's Besa WordPress theme (versions <=2.3.15) allows authenticated users with low privileges to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The CVSS 3.1 base score of 7.5 reflects high impact but requires authentication and high attack complexity. No active exploitation or public exploit code is known at the time of analysis.
Authenticated local file inclusion in the Fashion WordPress theme versions below 5.3.0 allows low-privilege attackers to read arbitrary files and potentially execute code through path traversal in include/require statements. No active exploitation or public proof of concept is known at this time; EPSS probability of exploitation is low (0.22%).
Local file inclusion in the Urna WordPress theme version 2.5.12 and earlier allows authenticated low-privilege users to include arbitrary local files, potentially leading to remote code execution. The vulnerability is not known to be actively exploited and has a very low EPSS score, though the CVSS base score is 7.5 due to potential for full system compromise.
Local File Inclusion in the Digiqole WordPress theme allows authenticated users to include arbitrary local files, leading to potential full system compromise. Versions prior to 2.2.7 are affected. The vulnerability has a high CVSS score but low EPSS exploitation probability and no known public exploit or active exploitation.
Local file inclusion in the ThimPress Sailing WordPress theme before version 4.4.6 allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving remote code execution. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) with a low EPSS probability (0.22%), indicating no active exploitation or publicly available exploit code at this time.
Authenticated local file inclusion in the ekommart WordPress theme before version 4.3.1 allows low-privileged users to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability stems from improper validation of user-supplied input used in PHP include statements.
Local File Inclusion in the Exhibz WordPress theme (version ≤ 3.0.9) allows authenticated attackers with low privileges to include arbitrary local files on the server, potentially leading to sensitive data exposure or-when combined with file upload-remote code execution. Exploitation requires high attack complexity and no user interaction; there is no evidence of active exploitation or public exploit code as of this analysis.
Local file inclusion in Jobmonster theme (≤4.8.2) allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution via chaining. The vulnerability requires low-privileged access (PR:L) and high attack complexity (AC:H), reducing real-world exploitability. EPSS score 0.22% suggests low exploitation probability, and no active exploits are confirmed.
Local file inclusion in Wilmër WordPress theme versions before 3.5 allows authenticated attackers to include arbitrary local files, leading to sensitive information disclosure and potential remote code execution. No public exploit or active exploitation has been reported at time of analysis; EPSS score is low (0.22%).
Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks. The vulnerability, rated Medium (CVSS 4.3), requires a valid user account but no other preconditions; it has a low EPSS score (0.07%) and is not known to be actively exploited.
Missing authorization in the Powerlift theme for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized modifications to theme data. The vulnerability affects all versions prior to 3.2.1 and requires only a valid WordPress user account to exploit. No active exploitation or public exploit code has been identified, and the EPSS score suggests low real-world exploitation probability.
Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control. No public exploit or active exploitation has been reported; EPSS probability is very low (0.05%).
DOM-Based Cross-Site Scripting (XSS) in KALLYAS WordPress theme versions below 4.25.0 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) and affects the theme's web page generation routines. EPSS probability is 0.01% (very low), suggesting minimal real-world exploitation likelihood despite the moderate CVSS score of 6.5.
Cross-site request forgery in KALLYAS WordPress theme versions before 4.25.0 allows authenticated attackers to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. The vulnerability requires user interaction (UI:N indicates no additional user interaction beyond authentication) and affects only confidentiality with low impact. While CVSS scores 4.3 (medium severity), the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite public awareness.
Missing authorization in the Traveler WordPress theme (<=3.2.6) allows unauthenticated attackers to perform actions with low integrity impact, bypassing access controls. No active exploitation or public exploit was identified at time of analysis, and EPSS indicates very low exploitation probability.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.1.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Alloggio - Hotel Booking WordPress theme through version 1.8 allows remote attackers to read arbitrary files on the server and potentially execute code by manipulating PHP include/require statements. The vulnerability stems from improper filename validation in file inclusion operations, enabling attackers to traverse directories and access sensitive files or configuration data. Exploitation probability is low (EPSS 0.07%, 22nd percentile) with no confirmed active exploitation or public proof-of-concept at time of analysis.
Remote file inclusion in Elated-Themes Savory WordPress theme through version 2.5 allows network-based attackers to execute arbitrary PHP code by manipulating file inclusion statements. Despite a CVSS score of 8.1, real-world exploitation risk appears low with an EPSS probability of 0.03% (8th percentile) and no evidence of active exploitation or public proof-of-concept code. The vulnerability classification as CWE-98 combined with conflicting tags (both RFI and LFI referenced) requires clarification - the attack complexity rating of High (AC:H) suggests non-trivial prerequisites for successful exploitation despite the network attack vector.
Local file inclusion in Revolution theme versions before 2.5.8 allows authenticated attackers with low privileges to include and execute arbitrary PHP files on the server via manipulated file paths. The vulnerability exploits improper validation of file inclusion parameters, enabling remote code execution when combined with file upload or log poisoning. EPSS score of 0.05% suggests low probability of mass exploitation, and no public POC or active exploitation (non-KEV) is confirmed at time of analysis.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local file inclusion in WordPress Academist theme versions prior to 1.3 enables remote attackers to include arbitrary PHP files from the server filesystem, leading to potential information disclosure, code execution, and full site compromise. The vulnerability stems from improper filename validation in PHP include/require statements. Despite a CVSS score of 8.1, the EPSS probability is only 0.05% (16th percentile), suggesting attackers have not widely adopted this technique, though the attack complexity is rated high. No confirmed active exploitation or public exploit code identified at time of analysis.
Local file inclusion in Houzez WordPress theme versions before 4.2.0 allows remote unauthenticated attackers to include and execute arbitrary PHP files through improper filename control in include/require statements. The vulnerability carries high CVSS severity (8.1) due to potential for remote code execution, though EPSS probability remains low (0.06%, 20th percentile) indicating limited observed exploitation attempts. No active exploitation confirmed by CISA KEV at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.10.5.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in uxper Togo togo.0.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Privilege Assignment vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in uxper Togo togo.0.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in ThemeNectar Salient salient.4.0. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in hogash Kallyas kallyas.22.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in hogash Kallyas kallyas.22.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in hogash Kallyas kallyas.22.0. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.1.42. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.10.5. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.10.5. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Local File Inclusion.54. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup GoStore gostore allows Reflected XSS.6.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local File Inclusion (LFI) in Leblix WordPress theme versions up to 2.4 allows remote unauthenticated attackers to include and execute arbitrary local files through improper filename control in PHP include/require statements. Despite the network attack vector (AV:N), exploitation requires high complexity conditions (AC:H), potentially involving specific configuration states or input validation bypasses. EPSS score of 0.04% (11th percentile) indicates low observed exploitation probability in the wild, and no CISA KEV listing confirms this remains a theoretical rather than actively exploited vulnerability. The vulnerability permits information disclosure through file content exposure and potentially code execution if attackers can chain LFI with other weaknesses like log poisoning or PHP wrapper abuse.
Local file inclusion vulnerability in Greenify WordPress theme (versions through 2.2) enables remote attackers to read arbitrary files from the web server filesystem, potentially exposing sensitive configuration files, credentials, and application source code. Exploitation requires specific conditions despite the network attack vector, reflected in the high attack complexity (AC:H) rating. EPSS score of 0.08% (23rd percentile) suggests low probability of mass exploitation, and no active exploitation has been confirmed via CISA KEV, though Patchstack has documented the vulnerability details.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Enzy enzy allows Reflected XSS.6.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote unauthenticated attackers can cause high-impact availability disruption in the Miraculous WordPress theme through arbitrary content deletion. The vulnerability allows exploitation of misconfigured access control in versions before 2.0.9, requiring no authentication or user interaction. EPSS score of 0.06% (18th percentile) indicates very low observed exploitation probability, with no public exploit code or CISA KEV listing at time of analysis. Despite CVSS 7.5 severity, the purely availability-focused impact (C:N/I:N/A:H) suggests this is a denial-of-service vector rather than a data breach risk.
Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.4.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.7.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Resca resca allows Reflected XSS.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.9.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP object injection in NooTheme WeMusic WordPress theme version ≤1.9.1 allows authenticated attackers with low privileges to execute arbitrary code or manipulate application logic through unsafe deserialization of untrusted data. Reported by Patchstack audit team. EPSS exploitation probability is low (0.10%, 27th percentile), indicating limited observed attacker interest despite the critical CVSS 8.8 rating. No active exploitation confirmed by CISA KEV at time of analysis.
Reflected cross-site scripting (XSS) in the WeMusic WordPress theme versions up to 1.9.1 allows remote attackers to execute arbitrary JavaScript in victims' browsers when they visit a specially crafted URL. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering such as phishing emails or malicious links. With EPSS exploitation probability of only 0.07% (20th percentile) and no CISA KEV listing, this represents a moderate theoretical risk but limited observed exploitation activity. Patchstack's reporting suggests responsible disclosure, though patch availability has not been independently confirmed.
Reflected cross-site scripting (XSS) in Kalium WordPress theme versions through 3.18.3 enables remote attackers to inject malicious scripts into web pages viewed by victims. Exploitation requires user interaction (clicking a crafted link) but no authentication, with changed scope indicating potential session hijacking or actions on behalf of victims across the theme's context. EPSS score of 0.05% (17th percentile) suggests low observed exploitation activity. No active exploitation confirmed via CISA KEV or public exploit code at time of analysis.
Local File Inclusion vulnerability in Zegen WordPress theme versions up to 1.1.9 allows authenticated remote attackers with low privileges to read arbitrary files on the server. Exploitation requires high attack complexity (AC:H), suggesting specific configuration or timing conditions must be met. EPSS score of 0.22% (45th percentile) indicates low probability of widespread exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local File Inclusion in Kinsley WordPress theme versions ≤3.4.4 enables remote attackers to read arbitrary server files and potentially execute code through improper filename control in PHP include/require statements. The vulnerability requires high attack complexity (AC:H) but needs no authentication (PR:N), allowing unauthenticated remote exploitation under specific conditions. EPSS score of 0.22% indicates low predicted exploitation probability, with no CISA KEV listing or public exploit code identified at time of analysis.
Path traversal vulnerability in Wanderland WordPress theme versions ≤1.7.1 enables remote unauthenticated PHP local file inclusion through crafted '.../...//' patterns. Successful exploitation allows reading arbitrary PHP files on the server, potentially exposing database credentials, configuration secrets, or achieving remote code execution if writable paths exist. EPSS score of 0.05% (17th percentile) indicates relatively low probability of mass exploitation, and no evidence of active exploitation in CISA KEV. Attack complexity is rated High (AC:H), suggesting exploitation requires specific timing, configuration conditions, or race conditions despite the remote unauthenticated attack vector.
Local file inclusion in Dør WordPress theme versions ≤2.4 allows remote attackers to read arbitrary files on the server and potentially achieve code execution through PHP wrapper manipulation. Despite the vulnerability title mentioning 'Remote File Inclusion', the CWE-98 classification and 'PHP Local File Inclusion' description indicate the actual vulnerability enables local file reads. Reported by Patchstack audit team with CVSS 8.1 severity, though EPSS probability of 0.14% (35th percentile) suggests limited observed exploitation activity. No CISA KEV listing indicating no confirmed widespread active exploitation at time of analysis.
Local file inclusion in the Dessau WordPress theme (versions up to 1.8) enables authenticated attackers with low-level privileges to read arbitrary files from the server filesystem via manipulated file inclusion paths. With attack complexity rated high (AC:H), successful exploitation requires specific conditions but grants access to sensitive configuration files, credentials, and potentially enables further attacks including remote code execution if combined with log poisoning or file upload capabilities. EPSS exploitation probability is low (0.14%, 35th percentile) with no confirmed active exploitation or public proof-of-concept code identified at time of analysis.
SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.
Cross-site request forgery in the Bard WordPress theme by Qode Interactive allows attackers to trick logged-in administrators into performing unintended actions on behalf of the attacker. The vulnerability affects Bard versions up to and including 1.6. The flaw has a medium severity score, very low exploitation probability, and no reports of active exploitation or publicly available exploit code.
Local File Inclusion in the StylemixThemes 'Consulting' WordPress theme (all versions up to but not including 6.7.5) lets an authenticated attacker control a filename passed to a PHP include/require statement, forcing the server to include and execute local files. Because arbitrary local PHP files can be executed, this can escalate to disclosure of sensitive files (wp-config.php credentials) and potential code execution via log poisoning or session/upload files. Reported by Patchstack; no public exploit identified at time of analysis, and EPSS is low at 0.05% (16th percentile).
Cross-Site Request Forgery in the WP Rentals WordPress theme (WpEstate) through version 3.13.1 allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking authenticated site users into visiting a crafted page. The CVSS vector (PR:N/UI:R) confirms the attacker needs no credentials themselves but must socially engineer a logged-in victim. With an EPSS of 0.01% (3rd percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is low at this time.
Broken access control in the wpresidence WordPress theme (versions through 5.3.2) exposes one or more endpoints that can be reached and triggered by unauthenticated remote attackers, resulting in unauthorized write-level actions against the site. The CVSS vector (PR:N, AV:N, AC:L) confirms no authentication is required, and the 'Authentication Bypass' tag indicates authorization checks are entirely absent rather than merely misconfigured. No public exploit code has been identified and EPSS sits at 0.04% (11th percentile), indicating very low real-world exploitation probability at this time.
Cross-Site Request Forgery in the Entrada WordPress theme (Waituk, versions through 5.7.7) enables a remote unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated user into visiting a crafted page. The missing or insufficient nonce validation on sensitive form or AJAX endpoints allows the victim's browser to unwittingly submit forged requests, resulting in limited integrity impact. With an EPSS score of 0.01% (3rd percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world risk is low despite the network-accessible vector.
Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.
PHP object injection in BoldThemes Addison WordPress theme versions prior to 1.4.8 enables unauthenticated remote attackers to execute arbitrary code through unsafe deserialization. The vulnerability carries a critical CVSS 9.8 score with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, with EPSS indicating 10th percentile exploitation probability (0.10%), suggesting low observed exploitation likelihood despite high theoretical severity.
Stored cross-site scripting in the Doctreat WordPress Theme through version 1.6.7 allows authenticated attackers to inject HTML and script code, enabling client-side code injection in visitors' browsers. Exploitation requires a contributor-level WordPress account but no user interaction from the victim. No public exploit code or active exploitation has been reported; EPSS indicates a very low likelihood of widespread attacks.
Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.
Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload a web shell, leading to complete compromise of the web server. This vulnerability, rated critical with CVSS 10.0 and CWE-434, is not currently listed in CISA KEV, and the EPSS score of 0.06% indicates low probability of widespread exploitation.
Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.
Authorization bypass in Houzez WordPress theme versions up to 4.2.5 allows authenticated users to access or modify resources they should not have permission to reach through insecure direct object reference (IDOR) vulnerabilities. An authenticated attacker with low privileges can exploit inadequately configured access controls to view or modify data belonging to other users, achieving limited information disclosure and integrity compromise. The vulnerability is not confirmed as actively exploited, though the attack vector is network-based with low complexity.
Local file inclusion in the WoodMart WordPress theme before version 8.3.2 allows authenticated low-privilege users (e.g., subscribers) to include arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete site compromise. Exploitation requires only low-level access but is of high complexity (CVSS 7.5, EPSS 0.13%), and no public exploit or active exploitation has been observed at the time of analysis.
Remote code injection in the Kalium WordPress theme (versions ≤ 3.25) allows unauthenticated attackers to execute arbitrary PHP code on the server. The vulnerability has a CVSS 3.1 base score of 7.2 (High) with low confidentiality and integrity impact and no availability impact. No active exploitation has been reported to date, and the EPSS score (0.09%) indicates a low probability of widespread exploitation.
Missing Authorization vulnerability in HaruTheme Frames allows Exploiting Incorrectly Configured Access Control Security Levels.5.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Woostify Woostify allows Stored XSS.4.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore allows Code Injection.5.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodexThemes TheGem allows Exploiting Incorrectly Configured Access Control Security Levels.10.5. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodexThemes TheGem (Elementor) allows Exploiting Incorrectly Configured Access Control Security Levels.10.5. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler allows Reflected XSS. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in shinetheme Traveler allows Exploiting Incorrectly Configured Access Control Security Levels. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated local file inclusion in the Jack Well WordPress theme (<=1.0.14) allows remote attackers to read arbitrary files or execute PHP code on the server via manipulated file paths. The vulnerability carries a CVSS 8.1 score but a low EPSS exploitation probability (0.08%); no active exploitation or public exploit is known at this time.
Local file inclusion in the AncoraThemes Ludos Paradise WordPress theme up to version 2.1.3 permits unauthenticated remote attackers to include arbitrary local files, exposing sensitive server data such as configuration files or credentials. The vulnerability is not known to be actively exploited, and no public exploit code is available. Despite a high CVSS rating, the low EPSS probability and high attack complexity suggest a limited real-world risk.
Local file inclusion in the Kings & Queens WordPress theme by AncoraThemes (through version 1.1.16) enables unauthenticated attackers
Unauthenticated local file inclusion in the Gracioza WordPress theme versions up to 1.0.15 lets remote attackers read arbitrary files and potentially execute code. The flaw stems from improper sanitization of filenames used in include statements (CWE-98). No known public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.
Local file inclusion in Militarology WordPress theme versions up to 1.0.15 allows unauthenticated remote attackers to include arbitrary local files, potentially exposing sensitive data and achieving remote code execution. The vulnerability carries a CVSS 3.1 score of 8.1 (high) but EPSS exploitation probability is low (0.08%), with no public exploit or active exploitation reported.
Local file inclusion in AncoraThemes ShieldGroup WordPress theme versions up to 2.13 enables unauthenticated remote attackers to include arbitrary local files. Despite high CVSS severity, EPSS indicates very low real-world exploitation probability; no active exploitation or public exploit code has been identified at time of analysis.
Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Server-side request forgery in LMPixels Kerge WordPress theme 4.1.3 and earlier allows unauthenticated attackers to coerce the theme into making server-side requests to arbitrary destinations. Successful exploitation can lead to limited information disclosure or interaction with internal services. No active exploitation or public exploit code is currently known, and the EPSS probability is very low (0.05%), suggesting a low immediate risk.
Broken access control in ThemeFusion Avada WordPress theme through version 7.13.2 allows authenticated attackers with low privileges to access functionality improperly constrained by access control lists, potentially achieving full site compromise. With CVSS 8.8 (High) due to network-based access requiring only low-privilege authentication, attackers can achieve high confidentiality, integrity, and availability impact. EPSS probability remains low at 0.06% (18th percentile), and no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite the critical CVSS rating.
Local file inclusion in the Hara WordPress theme (versions <= 1.2.17) allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure, code execution via PHP file inclusion chains, or full site takeover. The attack requires high complexity, and no exploit code or active exploitation has been publicly identified at the time of analysis.
Local File Inclusion vulnerability in the Turitor WordPress theme before version 1.5.3 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to information disclosure, code execution, or denial of service. No public exploit or active exploitation known at this time.
Local file inclusion vulnerability in thembay's Besa WordPress theme (versions <=2.3.15) allows authenticated users with low privileges to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The CVSS 3.1 base score of 7.5 reflects high impact but requires authentication and high attack complexity. No active exploitation or public exploit code is known at the time of analysis.
Authenticated local file inclusion in the Fashion WordPress theme versions below 5.3.0 allows low-privilege attackers to read arbitrary files and potentially execute code through path traversal in include/require statements. No active exploitation or public proof of concept is known at this time; EPSS probability of exploitation is low (0.22%).
Local file inclusion in the Urna WordPress theme version 2.5.12 and earlier allows authenticated low-privilege users to include arbitrary local files, potentially leading to remote code execution. The vulnerability is not known to be actively exploited and has a very low EPSS score, though the CVSS base score is 7.5 due to potential for full system compromise.
Local File Inclusion in the Digiqole WordPress theme allows authenticated users to include arbitrary local files, leading to potential full system compromise. Versions prior to 2.2.7 are affected. The vulnerability has a high CVSS score but low EPSS exploitation probability and no known public exploit or active exploitation.
Local file inclusion in the ThimPress Sailing WordPress theme before version 4.4.6 allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving remote code execution. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) with a low EPSS probability (0.22%), indicating no active exploitation or publicly available exploit code at this time.
Authenticated local file inclusion in the ekommart WordPress theme before version 4.3.1 allows low-privileged users to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability stems from improper validation of user-supplied input used in PHP include statements.
Local File Inclusion in the Exhibz WordPress theme (version ≤ 3.0.9) allows authenticated attackers with low privileges to include arbitrary local files on the server, potentially leading to sensitive data exposure or-when combined with file upload-remote code execution. Exploitation requires high attack complexity and no user interaction; there is no evidence of active exploitation or public exploit code as of this analysis.
Local file inclusion in Jobmonster theme (≤4.8.2) allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution via chaining. The vulnerability requires low-privileged access (PR:L) and high attack complexity (AC:H), reducing real-world exploitability. EPSS score 0.22% suggests low exploitation probability, and no active exploits are confirmed.
Local file inclusion in Wilmër WordPress theme versions before 3.5 allows authenticated attackers to include arbitrary local files, leading to sensitive information disclosure and potential remote code execution. No public exploit or active exploitation has been reported at time of analysis; EPSS score is low (0.22%).
Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks. The vulnerability, rated Medium (CVSS 4.3), requires a valid user account but no other preconditions; it has a low EPSS score (0.07%) and is not known to be actively exploited.
Missing authorization in the Powerlift theme for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized modifications to theme data. The vulnerability affects all versions prior to 3.2.1 and requires only a valid WordPress user account to exploit. No active exploitation or public exploit code has been identified, and the EPSS score suggests low real-world exploitation probability.
Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control. No public exploit or active exploitation has been reported; EPSS probability is very low (0.05%).
DOM-Based Cross-Site Scripting (XSS) in KALLYAS WordPress theme versions below 4.25.0 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) and affects the theme's web page generation routines. EPSS probability is 0.01% (very low), suggesting minimal real-world exploitation likelihood despite the moderate CVSS score of 6.5.
Cross-site request forgery in KALLYAS WordPress theme versions before 4.25.0 allows authenticated attackers to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. The vulnerability requires user interaction (UI:N indicates no additional user interaction beyond authentication) and affects only confidentiality with low impact. While CVSS scores 4.3 (medium severity), the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite public awareness.
Missing authorization in the Traveler WordPress theme (<=3.2.6) allows unauthenticated attackers to perform actions with low integrity impact, bypassing access controls. No active exploitation or public exploit was identified at time of analysis, and EPSS indicates very low exploitation probability.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.1.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Alloggio - Hotel Booking WordPress theme through version 1.8 allows remote attackers to read arbitrary files on the server and potentially execute code by manipulating PHP include/require statements. The vulnerability stems from improper filename validation in file inclusion operations, enabling attackers to traverse directories and access sensitive files or configuration data. Exploitation probability is low (EPSS 0.07%, 22nd percentile) with no confirmed active exploitation or public proof-of-concept at time of analysis.
Remote file inclusion in Elated-Themes Savory WordPress theme through version 2.5 allows network-based attackers to execute arbitrary PHP code by manipulating file inclusion statements. Despite a CVSS score of 8.1, real-world exploitation risk appears low with an EPSS probability of 0.03% (8th percentile) and no evidence of active exploitation or public proof-of-concept code. The vulnerability classification as CWE-98 combined with conflicting tags (both RFI and LFI referenced) requires clarification - the attack complexity rating of High (AC:H) suggests non-trivial prerequisites for successful exploitation despite the network attack vector.
Local file inclusion in Revolution theme versions before 2.5.8 allows authenticated attackers with low privileges to include and execute arbitrary PHP files on the server via manipulated file paths. The vulnerability exploits improper validation of file inclusion parameters, enabling remote code execution when combined with file upload or log poisoning. EPSS score of 0.05% suggests low probability of mass exploitation, and no public POC or active exploitation (non-KEV) is confirmed at time of analysis.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local file inclusion in WordPress Academist theme versions prior to 1.3 enables remote attackers to include arbitrary PHP files from the server filesystem, leading to potential information disclosure, code execution, and full site compromise. The vulnerability stems from improper filename validation in PHP include/require statements. Despite a CVSS score of 8.1, the EPSS probability is only 0.05% (16th percentile), suggesting attackers have not widely adopted this technique, though the attack complexity is rated high. No confirmed active exploitation or public exploit code identified at time of analysis.
Local file inclusion in Houzez WordPress theme versions before 4.2.0 allows remote unauthenticated attackers to include and execute arbitrary PHP files through improper filename control in include/require statements. The vulnerability carries high CVSS severity (8.1) due to potential for remote code execution, though EPSS probability remains low (0.06%, 20th percentile) indicating limited observed exploitation attempts. No active exploitation confirmed by CISA KEV at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.10.5.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in uxper Togo togo.0.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Privilege Assignment vulnerability in uxper Togo togo.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in uxper Togo togo.0.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in ThemeNectar Salient salient.4.0. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in hogash Kallyas kallyas.22.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in hogash Kallyas kallyas.22.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in hogash Kallyas kallyas.22.0. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.1.42. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.10.5. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.10.5. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Local File Inclusion.54. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup GoStore gostore allows Reflected XSS.6.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local File Inclusion (LFI) in Leblix WordPress theme versions up to 2.4 allows remote unauthenticated attackers to include and execute arbitrary local files through improper filename control in PHP include/require statements. Despite the network attack vector (AV:N), exploitation requires high complexity conditions (AC:H), potentially involving specific configuration states or input validation bypasses. EPSS score of 0.04% (11th percentile) indicates low observed exploitation probability in the wild, and no CISA KEV listing confirms this remains a theoretical rather than actively exploited vulnerability. The vulnerability permits information disclosure through file content exposure and potentially code execution if attackers can chain LFI with other weaknesses like log poisoning or PHP wrapper abuse.
Local file inclusion vulnerability in Greenify WordPress theme (versions through 2.2) enables remote attackers to read arbitrary files from the web server filesystem, potentially exposing sensitive configuration files, credentials, and application source code. Exploitation requires specific conditions despite the network attack vector, reflected in the high attack complexity (AC:H) rating. EPSS score of 0.08% (23rd percentile) suggests low probability of mass exploitation, and no active exploitation has been confirmed via CISA KEV, though Patchstack has documented the vulnerability details.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Enzy enzy allows Reflected XSS.6.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote unauthenticated attackers can cause high-impact availability disruption in the Miraculous WordPress theme through arbitrary content deletion. The vulnerability allows exploitation of misconfigured access control in versions before 2.0.9, requiring no authentication or user interaction. EPSS score of 0.06% (18th percentile) indicates very low observed exploitation probability, with no public exploit code or CISA KEV listing at time of analysis. Despite CVSS 7.5 severity, the purely availability-focused impact (C:N/I:N/A:H) suggests this is a denial-of-service vector rather than a data breach risk.
Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.4.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.7.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Resca resca allows Reflected XSS.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.9.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP object injection in NooTheme WeMusic WordPress theme version ≤1.9.1 allows authenticated attackers with low privileges to execute arbitrary code or manipulate application logic through unsafe deserialization of untrusted data. Reported by Patchstack audit team. EPSS exploitation probability is low (0.10%, 27th percentile), indicating limited observed attacker interest despite the critical CVSS 8.8 rating. No active exploitation confirmed by CISA KEV at time of analysis.
Reflected cross-site scripting (XSS) in the WeMusic WordPress theme versions up to 1.9.1 allows remote attackers to execute arbitrary JavaScript in victims' browsers when they visit a specially crafted URL. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering such as phishing emails or malicious links. With EPSS exploitation probability of only 0.07% (20th percentile) and no CISA KEV listing, this represents a moderate theoretical risk but limited observed exploitation activity. Patchstack's reporting suggests responsible disclosure, though patch availability has not been independently confirmed.
Reflected cross-site scripting (XSS) in Kalium WordPress theme versions through 3.18.3 enables remote attackers to inject malicious scripts into web pages viewed by victims. Exploitation requires user interaction (clicking a crafted link) but no authentication, with changed scope indicating potential session hijacking or actions on behalf of victims across the theme's context. EPSS score of 0.05% (17th percentile) suggests low observed exploitation activity. No active exploitation confirmed via CISA KEV or public exploit code at time of analysis.
Local File Inclusion vulnerability in Zegen WordPress theme versions up to 1.1.9 allows authenticated remote attackers with low privileges to read arbitrary files on the server. Exploitation requires high attack complexity (AC:H), suggesting specific configuration or timing conditions must be met. EPSS score of 0.22% (45th percentile) indicates low probability of widespread exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local File Inclusion in Kinsley WordPress theme versions ≤3.4.4 enables remote attackers to read arbitrary server files and potentially execute code through improper filename control in PHP include/require statements. The vulnerability requires high attack complexity (AC:H) but needs no authentication (PR:N), allowing unauthenticated remote exploitation under specific conditions. EPSS score of 0.22% indicates low predicted exploitation probability, with no CISA KEV listing or public exploit code identified at time of analysis.
Path traversal vulnerability in Wanderland WordPress theme versions ≤1.7.1 enables remote unauthenticated PHP local file inclusion through crafted '.../...//' patterns. Successful exploitation allows reading arbitrary PHP files on the server, potentially exposing database credentials, configuration secrets, or achieving remote code execution if writable paths exist. EPSS score of 0.05% (17th percentile) indicates relatively low probability of mass exploitation, and no evidence of active exploitation in CISA KEV. Attack complexity is rated High (AC:H), suggesting exploitation requires specific timing, configuration conditions, or race conditions despite the remote unauthenticated attack vector.
Local file inclusion in Dør WordPress theme versions ≤2.4 allows remote attackers to read arbitrary files on the server and potentially achieve code execution through PHP wrapper manipulation. Despite the vulnerability title mentioning 'Remote File Inclusion', the CWE-98 classification and 'PHP Local File Inclusion' description indicate the actual vulnerability enables local file reads. Reported by Patchstack audit team with CVSS 8.1 severity, though EPSS probability of 0.14% (35th percentile) suggests limited observed exploitation activity. No CISA KEV listing indicating no confirmed widespread active exploitation at time of analysis.
Local file inclusion in the Dessau WordPress theme (versions up to 1.8) enables authenticated attackers with low-level privileges to read arbitrary files from the server filesystem via manipulated file inclusion paths. With attack complexity rated high (AC:H), successful exploitation requires specific conditions but grants access to sensitive configuration files, credentials, and potentially enables further attacks including remote code execution if combined with log poisoning or file upload capabilities. EPSS exploitation probability is low (0.14%, 35th percentile) with no confirmed active exploitation or public proof-of-concept code identified at time of analysis.
SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.
Cross-site request forgery in the Bard WordPress theme by Qode Interactive allows attackers to trick logged-in administrators into performing unintended actions on behalf of the attacker. The vulnerability affects Bard versions up to and including 1.6. The flaw has a medium severity score, very low exploitation probability, and no reports of active exploitation or publicly available exploit code.
Local File Inclusion in the StylemixThemes 'Consulting' WordPress theme (all versions up to but not including 6.7.5) lets an authenticated attacker control a filename passed to a PHP include/require statement, forcing the server to include and execute local files. Because arbitrary local PHP files can be executed, this can escalate to disclosure of sensitive files (wp-config.php credentials) and potential code execution via log poisoning or session/upload files. Reported by Patchstack; no public exploit identified at time of analysis, and EPSS is low at 0.05% (16th percentile).
Cross-Site Request Forgery in the WP Rentals WordPress theme (WpEstate) through version 3.13.1 allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking authenticated site users into visiting a crafted page. The CVSS vector (PR:N/UI:R) confirms the attacker needs no credentials themselves but must socially engineer a logged-in victim. With an EPSS of 0.01% (3rd percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is low at this time.
Broken access control in the wpresidence WordPress theme (versions through 5.3.2) exposes one or more endpoints that can be reached and triggered by unauthenticated remote attackers, resulting in unauthorized write-level actions against the site. The CVSS vector (PR:N, AV:N, AC:L) confirms no authentication is required, and the 'Authentication Bypass' tag indicates authorization checks are entirely absent rather than merely misconfigured. No public exploit code has been identified and EPSS sits at 0.04% (11th percentile), indicating very low real-world exploitation probability at this time.
Cross-Site Request Forgery in the Entrada WordPress theme (Waituk, versions through 5.7.7) enables a remote unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated user into visiting a crafted page. The missing or insufficient nonce validation on sensitive form or AJAX endpoints allows the victim's browser to unwittingly submit forged requests, resulting in limited integrity impact. With an EPSS score of 0.01% (3rd percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world risk is low despite the network-accessible vector.
Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.
PHP object injection in BoldThemes Addison WordPress theme versions prior to 1.4.8 enables unauthenticated remote attackers to execute arbitrary code through unsafe deserialization. The vulnerability carries a critical CVSS 9.8 score with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, with EPSS indicating 10th percentile exploitation probability (0.10%), suggesting low observed exploitation likelihood despite high theoretical severity.
Stored cross-site scripting in the Doctreat WordPress Theme through version 1.6.7 allows authenticated attackers to inject HTML and script code, enabling client-side code injection in visitors' browsers. Exploitation requires a contributor-level WordPress account but no user interaction from the victim. No public exploit code or active exploitation has been reported; EPSS indicates a very low likelihood of widespread attacks.
Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.
Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload a web shell, leading to complete compromise of the web server. This vulnerability, rated critical with CVSS 10.0 and CWE-434, is not currently listed in CISA KEV, and the EPSS score of 0.06% indicates low probability of widespread exploitation.
Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.
Authorization bypass in Houzez WordPress theme versions up to 4.2.5 allows authenticated users to access or modify resources they should not have permission to reach through insecure direct object reference (IDOR) vulnerabilities. An authenticated attacker with low privileges can exploit inadequately configured access controls to view or modify data belonging to other users, achieving limited information disclosure and integrity compromise. The vulnerability is not confirmed as actively exploited, though the attack vector is network-based with low complexity.
Local file inclusion in the WoodMart WordPress theme before version 8.3.2 allows authenticated low-privilege users (e.g., subscribers) to include arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete site compromise. Exploitation requires only low-level access but is of high complexity (CVSS 7.5, EPSS 0.13%), and no public exploit or active exploitation has been observed at the time of analysis.
Remote code injection in the Kalium WordPress theme (versions ≤ 3.25) allows unauthenticated attackers to execute arbitrary PHP code on the server. The vulnerability has a CVSS 3.1 base score of 7.2 (High) with low confidentiality and integrity impact and no availability impact. No active exploitation has been reported to date, and the EPSS score (0.09%) indicates a low probability of widespread exploitation.
Missing Authorization vulnerability in HaruTheme Frames allows Exploiting Incorrectly Configured Access Control Security Levels.5.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Woostify Woostify allows Stored XSS.4.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore allows Code Injection.5.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodexThemes TheGem allows Exploiting Incorrectly Configured Access Control Security Levels.10.5. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodexThemes TheGem (Elementor) allows Exploiting Incorrectly Configured Access Control Security Levels.10.5. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler allows Reflected XSS. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in shinetheme Traveler allows Exploiting Incorrectly Configured Access Control Security Levels. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.