Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-12
CVE-2025-28945 - Allows Php Local File Inclusion Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a through 2.4.
THEME
Allows Php Local File Inclusion
CVE-2025-28945
Risk Score
Threat Entry
Updated 2025-06-12
CVE-2023-25999 - Allows Php Local File Inclusion Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme BodyCenter - Gym, Fitness WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects BodyCenter - Gym, Fitness WooCommerce WordPress Theme: from n/a through 2.4.
THEME
Allows Php Local File Inclusion
CVE-2023-25999
Risk Score
Threat Entry
Updated 2025-06-06
CVE-2025-1778 - Art Theme
The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the theme option.
THEME
Art
CVE-2025-1778
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2025-4797 - Golo City Travel Guide Wordpress Theme
The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it possible for unauthenticated attackers to log in as any user, including administrators, provided they know the user's email address.
THEME
Golo City Travel Guide Wordpress Theme
CVE-2025-4797
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2025-31912 - Allows Php Local File Inclusion Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Enzio - Responsive Business WordPress Theme allows PHP Local File Inclusion. This issue affects Enzio - Responsive Business WordPress Theme: from n/a through 1.1.8.
THEME
Allows Php Local File Inclusion
CVE-2025-31912
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2025-31633 - Allows Php Local File Inclusion Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a through 1.3.3.
THEME
Allows Php Local File Inclusion
CVE-2025-31633
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2025-4524 - Responsive And Modern Wordpress Theme For Manga Sites
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
THEME
Responsive And Modern Wordpress Theme For Manga Sites
CVE-2025-4524
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2025-4322 - Motors Theme
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
THEME
Motors
CVE-2025-4322
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2025-47576 - Vulnerability In Bringthepixel Bimber Viral Magazine Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine WordPress Theme.This issue affects Bimber - Viral Magazine WordPress Theme: from n/a through 9.2.5.
THEME
Vulnerability In Bringthepixel Bimber Viral Magazine
CVE-2025-47576
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2025-4317 - Thegem Theme
The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegem_get_logo_url() function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
THEME
Thegem
CVE-2025-4317
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2025-4339 - Thegem Theme
The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary theme options.
THEME
Thegem
CVE-2025-4339
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2024-13793 - Multi Vendor Marketplace Woocommerce Theme
The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
THEME
Multi Vendor Marketplace Woocommerce Theme
CVE-2024-13793
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-13738 - Listing Wordpress Theme
The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. *It is unclear exactly which version the issue was patched in from the changelog. Therefore, we used the latest version at the time of verification.
THEME
Listing Wordpress Theme
CVE-2024-13738
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-13858 - Buddyboss Platform Plugin And Buddyboss Theme
The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in the BuddyBoss Platform plugin in version 2.8.41.
THEME
Buddyboss Platform Plugin And Buddyboss
CVE-2024-13858
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2025-1327 - Homey Theme
The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's accounts.
THEME
Homey
CVE-2025-1327
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2025-1326 - Homey Theme
The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.
THEME
Homey
CVE-2025-1326
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2025-1305 - Newsblogger Theme
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
THEME
Newsblogger
CVE-2025-1305
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2025-1304 - Newsblogger Theme
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
THEME
Newsblogger
CVE-2025-1304
Risk Score
Threat Entry
Updated 2025-04-29
CVE-2025-2101 - Edumall Theme
The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
THEME
Edumall
CVE-2025-2101
Risk Score
Threat Entry
Updated 2025-04-29
CVE-2025-2470 - Used By The Service Finder Directory And Job Board Theme
The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability.
THEME
Used By The Service Finder Directory And Job Board
CVE-2025-2470
Risk Score