Vulnerabilities

TI-2025-36049 CVE-2025-58244 · GHSA-gp4w-5j3f-5q5p

WordPress Constructo Theme <= 4.3.9 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through <= 4.3.9.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0017 Published 2025-09-22 No fix listed CWE-352

TI-2024-12838 CVE-2024-13812 · GHSA-j6m6-gq73-6859

Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution

LOW 35

The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00363 Published 2025-04-26 No fix listed CWE-94

TI-2024-12418 CVE-2024-13376 · GHSA-fv8q-f428-3p67

Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

MEDIUM 40

The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the _ajax_get_total_content_import_items() function in all…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00362 Published 2025-03-14 No fix listed CWE-269

Vulnerabilities

Filters

WordPress Constructo Theme <= 4.3.9 - Cross Site Request Forgery (CSRF) Vulnerability

Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution

Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update