#CVE

CVE 2025-07-08

CVE-2025-4606: Unauthenticated Password Reset and Account Takeover in Sala

CVE-2025-4606 affects the Sala – Startup & SaaS WordPress Theme through version 1.1.4. The vulnerability allows unauthenticated attackers to change passwords for arbitrary users, including administrators, because the password-update functionality does not properly establish the identity of the reque...

4 min read read

CVE 2025-07-03

CVE-2025-4601: Authenticated Privilege Escalation in RealHomes

CVE-2025-4601 affects the RH - Real Estate WordPress Theme through version 4.4.0. An authenticated user with subscriber-level access or higher can potentially manipulate their account role and escalate to administrator privileges.

4 min read read

CVE 2025-05-16

CVE-2025-47577: Unauthenticated Arbitrary File Upload in TI WooCommerce Wishlist

CVE-2025-47577 affects the TI WooCommerce Wishlist WordPress plugin through version 2.9.2. The issue is an unrestricted file upload vulnerability that can allow an unauthenticated attacker to place dangerous files on a vulnerable WordPress installation, with potential for remote code execution depen...

5 min read read

CVE 2025-05-16

CVE-2025-4389: Unauthenticated Arbitrary File Upload in Crawlomatic Multipage Scraper Post Generator

Unauthenticated Arbitrary File Upload in Crawlomatic Multipage Scraper Post Generator

7 min read read

CVE 2025-05-08

CVE-2025-4403: Unauthenticated Arbitrary File Upload in Drag and Drop Multiple File Upload for WooCommerce

Unauthenticated Arbitrary File Upload in Drag and Drop Multiple File Upload for WooCommerce

5 min read read

CVE 2025-04-06

CVE-2025-3419: Unauthenticated Arbitrary File Read in Eventin

CVE-2025-3419 affects the Event Manager, Events Calendar, Tickets, Registrations – Eventin WordPress plugin through version 4.0.26. The vulnerability allows unauthenticated attackers to read arbitrary files from the server through the plugin's image-proxy functionality, potentially exposing sensitiv...

4 min read read

CVE 2025-04-04

CVE-2025-2907: Unauthenticated Arbitrary Options Update in Order Delivery Date for WooCommerce

Unauthenticated Arbitrary Options Update in Order Delivery Date for WooCommerce

7 min read read

CVE 2025-03-27

CVE-2025-2294: Unauthenticated Local File Inclusion in Kubio AI Page Builder

Critical vulnerability affecting the Kubio AI Page Builder WordPress plugin

1 min read read

CVE 2025-03-20

CVE-2025-2539: Unauthenticated Arbitrary File Read in File Away

CVE-2025-2539 affects the File Away WordPress plugin through version 3.9.9.0.1. The vulnerability allows unauthenticated attackers to access arbitrary files on the server through an AJAX-based file operation.

4 min read read