Vulnerabilities

TI-2025-10230 CVE-2025-11164 · GHSA-g6w6-46cp-5mrg

Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation

LOW 19

The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_plugin' AJAX action in all versions up to, and including, 1.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00188 Published 2025-12-13 No fix listed CWE-862

TI-2024-25237 CVE-2024-37931 · GHSA-j27q-8m9v-cph3

WordPress Point theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00183 Published 2025-01-02 No fix listed CWE-352

Vulnerabilities

Filters

Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation

WordPress Point theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability