Vendors / aonetheme Records 11 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 6
CVSS high 4
Exploited now aonetheme records in CISA KEV No aonetheme vulnerabilities are listed in CISA KEV.
Priority MEDIUM 56
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04863 · Published 2025-08-01 · No fix listed CWE-639
Priority MEDIUM 50
Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through <= 6.1.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00803 · Published 2025-07-04 · No fix listed CWE-266
Priority MEDIUM 49
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00439 · Published 2025-09-19 · No fix listed CWE-639
Priority MEDIUM 49
The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00469 · Published 2025-04-25 · No fix listed CWE-266
Priority MEDIUM 49
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00435 · Published 2025-03-19 · No fix listed CWE-288
Priority MEDIUM 42
The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00468 · Published 2025-08-01 · No fix listed CWE-269
Priority MEDIUM 40
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00417 · Published 2026-08-13 · No fix listed CWE-266
Priority MEDIUM 40
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00304 · Published 2025-11-01 · Fixed in 6.1 CWE-639
Priority LOW 38
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0.
CVSS 3.1 HIGH 8.1· Network · No auth · No interaction · EPSS 0.00448 · Published 2025-09-19 · No fix listed CWE-288
Priority LOW 38
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00375 · Published 2025-11-01 · No fix listed CWE-639
Priority LOW 29
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00368 · Published 2026-08-13 · No fix listed CWE-862
Open these records in search → All records by CVSS severity
6 4 1 0 0
THREATIST.IORead the docs