PX-lab

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

PX-lab records in CISA KEV

No PX-lab vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-69922 CVE-2026-94503 · GHSA-wp92-94wv-wf8f

Unrestricted file upload in WordPress Zombify plugin

MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0035 Published 2026-10-09 No fix listed CWE-434

TI-2024-11917 CVE-2024-12859 · GHSA-vv4q-84xw-r5qv

BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode

MEDIUM 41

The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00604 Published 2025-02-03 No fix listed CWE-98

TI-2024-11405 CVE-2024-12295 · GHSA-wq5g-2475-cmrr

Weak password recovery in PX-lab BoomBox Theme Extensions

MEDIUM 40

The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.8.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00373 Published 2025-03-19 No fix listed CWE-640

TI-2025-07676 CVE-2025-8385 · GHSA-xc8j-5rr8-8q9r

Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read

LOW 30

The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00397 Published 2025-10-31 No fix listed CWE-22

Open these records in search →

Critical	1
High	2
Medium	1
Low	0
No CVSS	0