Read the docs

RiceTheme

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

RiceTheme records in CISA KEV

No RiceTheme vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2025-09940 CVE-2025-10850 · GHSA-wrg3-6p86-gf29

Felan Framework <= 1.1.4 - Hardcoded Credentials

Priority MEDIUM 50

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00608 Published 2025-10-16 No fix listed CWE-798
TI-2025-17271 CVE-2025-23504 · GHSA-8r96-x95v-q4mh

WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability

Priority MEDIUM 49

Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00492 Published 2026-01-08 No fix listed CWE-288
TI-2025-17760 CVE-2025-23993 · GHSA-7h89-54x4-x67j

WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability

Priority MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <=…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00398 Published 2026-01-08 No fix listed CWE-89
TI-2025-09939 CVE-2025-10849 · GHSA-w7vf-h9wj-xgpw

Missing authorization in RiceTheme Felan Framework

Priority LOW 30

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via an AJAX action in versions up to, and incl…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00316 Published 2025-10-16 No fix listed CWE-862
Open these records in search →