purethemes

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

purethemes records in CISA KEV

No purethemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Realteo 3 records MEDIUM Findeo 2 records LOW Listeo 2 records LOW Workscout 1 record LOW Workscout Core 1 record LOW

Records

3 records in Realteo · all components

TI-2025-01959 CVE-2025-2232 · GHSA-cghv-p6j4-5ch6

Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'

MEDIUM 50

The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00552 Published 2025-03-14 No fix listed CWE-269

TI-2021-06529 CVE-2021-24237 · GHSA-fr4g-crj4-v8hc

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

LOW 36

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06275 Published 2021-04-22 Fixed in 1.2.4, 1.3.1 CWE-79

TI-2021-06530 CVE-2021-24238 · GHSA-828j-hg8h-vf6g

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

LOW 31

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary pr…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01114 Published 2021-04-22 Fixed in 1.2.4, 1.3.1 CWE-284

Open these records in search →

Critical	1
High	8
Medium	8
Low	0
No CVSS	0