Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-03-28
CVE-2025-1771 - Traveler Theme
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
THEME
Traveler
CVE-2025-1771
Risk Score
Threat Entry
Updated 2025-03-28
CVE-2025-1773 - Traveler Theme
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
THEME
Traveler
CVE-2025-1773
Risk Score
Threat Entry
Updated 2025-03-27
CVE-2024-13773 - Civi Theme
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys.
THEME
Civi
CVE-2024-13773
Risk Score
Threat Entry
Updated 2025-03-28
CVE-2024-13771 - Plugin For Wordpress Is Vulnerable To Authentication Bypass In All Versions Up To Theme
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.
THEME
Plugin For Wordpress Is Vulnerable To Authentication Bypass In All Versions Up To
CVE-2024-13771
Risk Score
Threat Entry
Updated 2025-03-27
CVE-2024-12810 - Job Board Responsive Wordpress Theme
The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files, generate backups, restore backups, update theme options, and reset theme options to default settings.
THEME
Job Board Responsive Wordpress Theme
CVE-2024-12810
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2024-13772 - Plugin For Wordpress Is Vulnerable To Authentication Bypass In All Versions Up To Theme
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.
THEME
Plugin For Wordpress Is Vulnerable To Authentication Bypass In All Versions Up To
CVE-2024-13772
Risk Score
Threat Entry
Updated 2025-03-24
CVE-2025-1526 - Dethemekit For Elementor
The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown feature) in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Dethemekit For Elementor
CVE-2025-1526
Risk Score
Threat Entry
Updated 2025-03-21
CVE-2024-13824 - Ciyashop Multipurpose Woocommerce Theme
The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deserialization of untrusted input in the 'add_ciyashop_wishlist' and 'ciyashop_get_compare' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed…
THEME
Ciyashop Multipurpose Woocommerce Theme
CVE-2024-13824
Risk Score
Threat Entry
Updated 2025-03-21
CVE-2025-2289 - Zegen Church Wordpress Theme
The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import, export, and update theme options.
THEME
Zegen Church Wordpress Theme
CVE-2025-2289
Risk Score
Threat Entry
Updated 2025-03-14
CVE-2025-0952 - Eco Nature - Environment & Ecology WordPress Theme
The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users…
THEME
Eco Nature - Environment & Ecology WordPress Theme
CVE-2025-0952
Risk Score
Threat Entry
Updated 2025-03-14
CVE-2024-13376 - Industrial Theme
The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the _ajax_get_total_content_import_items() function in all versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
THEME
Industrial
CVE-2024-13376
Risk Score
Threat Entry
Updated 2025-03-14
CVE-2025-1285 - Resido - Real Estate WordPress Theme
The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to internal services and update API key details.
THEME
Resido - Real Estate WordPress Theme
CVE-2025-1285
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-10326 - Romethemekit For Elementor
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or reset plugin widgets to their default state (all enabled). NOTE: This vulnerability was partially fixed in version 1.5.3.
THEME
Romethemekit For Elementor
CVE-2024-10326
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-12876 - Golo City Travel Guide Wordpress Theme
The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.10. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
THEME
Golo City Travel Guide Wordpress Theme
CVE-2024-12876
Risk Score
Threat Entry
Updated 2025-03-07
CVE-2025-1309 - UiPress lite | Effortless custom dashboards, admin themes and pages
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to…
THEME
UiPress lite | Effortless custom dashboards, admin themes and pages
CVE-2025-1309
Risk Score
Threat Entry
Updated 2025-03-07
CVE-2024-13655 - Flex Mag Responsive Wordpress News Theme
The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
THEME
Flex Mag Responsive Wordpress News Theme
CVE-2024-13655
Risk Score
Threat Entry
Updated 2025-03-07
CVE-2025-0749 - Homey Theme
The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user.
THEME
Homey
CVE-2025-0749
Risk Score
Threat Entry
Updated 2025-03-07
CVE-2025-0748 - Homey Theme
The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
THEME
Homey
CVE-2025-0748
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-12281 - Homey Theme
The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Editor or Shop Manager role.
THEME
Homey
CVE-2024-12281
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-13423 - Sparkling Theme
The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins.
THEME
Sparkling
CVE-2024-13423
Risk Score