CVE

CVE 2026-06-09

CVE-2025-6254: Unauthenticated Administrator Registration in Doctreat Core

CVE-2025-6254 affects the Doctreat Core WordPress plugin through version 1.6.8. The vulnerability allows unauthenticated attackers to register an account with administrator privileges because the registration handler does not properly restrict the requested role.

4 min read read

CVE 2026-05-20

CVE-2026-5118: Unauthenticated Privilege Escalation in Divi Form Builder

CVE-2026-5118 affects Divi Form Builder through version 5.1.2. The vulnerability allows unauthenticated attackers to create administrator accounts by manipulating the role value accepted during public form registration.

4 min read read

CVE 2026-05-13

CVE-2026-8181: Authentication Bypass in Burst Statistics

CVE-2026-8181 affects Burst Statistics – Privacy-Friendly WordPress Analytics versions 3.4.0 through 3.4.1.1. The vulnerability is an authentication bypass that can allow an unauthenticated attacker who knows an administrator username to impersonate that administrator during a request.

4 min read read

CVE 2026-03-20

CVE-2026-3584: Unauthenticated Remote Code Execution in Kali Forms

CVE-2026-3584 affects the Kali Forms WordPress plugin through version 2.4.9. The vulnerability allows unauthenticated remote code execution through the form_process functionality because attacker-controlled values can reach dynamic PHP callback execution.

4 min read read

CVE 2025-08-05

CVE-2025-52078: Unauthenticated Arbitrary File Upload in Writebot

CVE-2025-52078 affects the Writebot – AI Content Generator SaaS React Template through version 4.0.0. The vulnerability is an unauthenticated file-upload issue associated with the /file-upload endpoint.

4 min read read

CVE 2025-07-14

CVE-2025-5394: Unauthenticated Arbitrary Plugin Upload in Alone Theme

CVE-2025-5394 affects the Alone – Charity Multipurpose Non-profit WordPress Theme through version 7.8.3. The theme exposes a plugin-installation function without sufficient capability checks, allowing unauthenticated attackers to upload and install plugin packages from remote locations.

4 min read read

CVE 2025-07-08

CVE-2025-4606: Unauthenticated Password Reset and Account Takeover in Sala

CVE-2025-4606 affects the Sala – Startup & SaaS WordPress Theme through version 1.1.4. The vulnerability allows unauthenticated attackers to change passwords for arbitrary users, including administrators, because the password-update functionality does not properly establish the identity of the reque...

4 min read read

CVE 2025-07-03

CVE-2025-4601: Authenticated Privilege Escalation in RealHomes

CVE-2025-4601 affects the RH - Real Estate WordPress Theme through version 4.4.0. An authenticated user with subscriber-level access or higher can potentially manipulate their account role and escalate to administrator privileges.

4 min read read

CVE 2025-05-16

CVE-2025-47577: Unauthenticated Arbitrary File Upload in TI WooCommerce Wishlist

CVE-2025-47577 affects the TI WooCommerce Wishlist WordPress plugin through version 2.9.2. The issue is an unrestricted file upload vulnerability that can allow an unauthenticated attacker to place dangerous files on a vulnerable WordPress installation, with potential for remote code execution depen...

5 min read read