Vulnerabilities

TI-2026-28526 CVE-2026-39552 · GHSA-pw35-mfxv-755m

WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00334 Published 2026-06-02 Fixed in 1.1.5 CWE-98

TI-2024-08325 CVE-2024-8965 · GHSA-vqqh-7rx8-gc89

Absolute Reviews <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name

LOW 28

The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00313 Published 2024-09-27 No fix listed CWE-79

TI-2024-08378 CVE-2024-9025 · GHSA-vpxh-qgmv-7643

Missing authorization in codesupplyco Sight – Professional Image Gallery and Portfolio

LOW 30

The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and inc…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0036 Published 2024-09-26 No fix listed CWE-862

TI-2021-03283 CVE-2021-4426 · GHSA-2q53-wj8h-wcgw

Absolute Reviews <= 1.0.8 - Cross-Site Request Forgery Bypass

LOW 21

The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00563 Published 2023-07-12 No fix listed CWE-352

TI-2021-07122 CVE-2021-24840 · GHSA-25vj-qm23-fx63

Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure

LOW 26

The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01168 Published 2021-11-08 Fixed in 3.0.4 CWE-639