Read the docs

PenciDesign

Records35All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

PenciDesign records in CISA KEV

No PenciDesign vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Soledad 8 records MEDIUM

Records

8 records in Soledad · all components

TI-2023-27230 CVE-2023-49826 · GHSA-c82j-mm7v-vfp8

WordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object Injection

Priority MEDIUM 44

Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Them…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00562 Published 2023-12-21 No fix listed CWE-502
TI-2023-27229 CVE-2023-49825 · GHSA-4m4j-w3qr-4gcc

WordPress Soledad Theme <= 8.4.1 is vulnerable to SQL Injection

Priority LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipu…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00528 Published 2023-12-20 No fix listed CWE-89
TI-2023-27231 CVE-2023-49827 · GHSA-q62r-62c5-h547

WordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affe…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00393 Published 2023-12-14 No fix listed CWE-79
TI-2022-02964 CVE-2022-3209 · GHSA-c975-8p92-pprh

Soledad < 8.2.5 - Reflected Cross-site Scripting

Priority LOW 28

The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00618 Published 2022-10-10 Fixed in 8.2.5 CWE-79
Open these records in search →