Bearsthemes

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Bearsthemes records in CISA KEV

No Bearsthemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Sermons Online 1 record LOW

Records

7 records

TI-2025-04846 CVE-2025-5394 · GHSA-jg98-c5j8-6598

Missing authorization in Bearsthemes Alone – Charity Multipurpose Non-profit WordPress…

HIGH 81

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.53247 Published 2025-07-15 No fix listed CWE-862

TI-2025-04848 CVE-2025-5396 · GHSA-mr9j-vgmq-cxhq

Bears Backup <= 2.0.0 - Unauthenticated Remote Code Execution

MEDIUM 51

The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00879 Published 2025-07-17 No fix listed CWE-94

TI-2025-09787 CVE-2025-10690 · GHSA-66g5-p6w6-whj9

Missing authorization in Bearsthemes Goza - Nonprofit Charity WordPress Theme

MEDIUM 50

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00781 Published 2025-09-19 No fix listed CWE-862

TI-2025-04845 CVE-2025-5393 · GHSA-844q-6pvj-pfmf

Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization…

MEDIUM 46

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all ve…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00643 Published 2025-07-15 No fix listed CWE-73

TI-2026-01024 CVE-2026-1311 · GHSA-xp3r-qr68-xr3w

Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload

MEDIUM 42

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00826 Published 2026-02-26 No fix listed CWE-22

TI-2025-09306 CVE-2025-10134 · GHSA-gp34-q874-5pw2

Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion

MEDIUM 40

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, a…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00561 Published 2025-09-09 No fix listed CWE-73

TI-2023-17866 CVE-2023-35776 · GHSA-qr4m-38rf-6gjq

WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00511 Published 2023-06-19 No fix listed CWE-79

Open these records in search →

Critical	5
High	1
Medium	1
Low	0
No CVSS	0