sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total17
Critical1
High6
Medium10
Reset
Showing 1-17 of 17 records
Threat Entry Updated 2026-06-17

Woodmart - Path Traversal (CVE-2025-49935)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in xtemos WoodMart woodmart allows PHP Local File Inclusion.This issue affects WoodMart: from n/a through < 8.3.2.

THEME Woodmart

CVE-2025-49935

HIGH CVSS 7.5 2025-10-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Woodmart - Improper Input Validation (CVE-2025-8097)

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.

PLUGIN Woodmart

CVE-2025-8097

MEDIUM CVSS 5.3 2025-07-26
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WoodMart - Information Disclosure (CVE-2025-6745)

The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

PLUGIN WoodMart

CVE-2025-6745

MEDIUM CVSS 5.3 2025-07-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Woodmart - Security Vulnerability (CVE-2025-6744)

The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_get_products_shortcode() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

PLUGIN Woodmart

CVE-2025-6744

HIGH CVSS 7.3 2025-07-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Woodmart - Path Traversal (CVE-2025-6746)

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

PLUGIN Woodmart

CVE-2025-6746

HIGH CVSS 8.8 2025-07-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Woodmart - Cross-Site Scripting (XSS) (CVE-2025-6743)

The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Woodmart

CVE-2025-6743

MEDIUM CVSS 6.4 2025-07-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Woodmart - Security Vulnerability (CVE-2024-12333)

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

THEME Woodmart

CVE-2024-12333

MEDIUM CVSS 6.5 2024-12-12
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.