Vulnerabilities

Filters

Reset all

1 selected

35 records

Sort

Vendor: g5theme Clear all filters

TI-2026-24993 CVE-2026-32465 · GHSA-667w-p3xr-xc83

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

MEDIUM 41

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00518 Published 2026-08-18 No fix listed CWE-502

TI-2026-28683 CVE-2026-39714 · GHSA-3rjq-96vg-4j89

WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability

LOW 23

Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00194 Published 2026-04-08 No fix listed CWE-862

TI-2026-28637 CVE-2026-39668 · GHSA-j4m2-98ph-wgm7

WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for W…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00236 Published 2026-04-08 No fix listed CWE-862

TI-2026-21547 CVE-2026-27088 · GHSA-j895-gc2p-77r2

WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00182 Published 2026-03-25 No fix listed CWE-79

TI-2026-21546 CVE-2026-27087 · GHSA-5263-vppj-gv4j

WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00182 Published 2026-03-25 No fix listed CWE-79

TI-2026-18101 CVE-2026-22520 · GHSA-979w-pv5p-v945

WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a thr…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00239 Published 2026-03-25 No fix listed CWE-79

TI-2025-42550 CVE-2025-69096 · GHSA-8mwf-fh3g-cqp9

WordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zorka: from n/a through <= 1.5.7.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00239 Published 2026-03-25 No fix listed CWE-79

TI-2026-18102 CVE-2026-22521 · GHSA-f5vm-3c88-r99x

WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Local File Inclusion.This issue affects Ha…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00451 Published 2026-01-08 No fix listed CWE-98

TI-2026-00468 CVE-2026-0676 · GHSA-qf5w-6pph-h289

WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2026-01-08 No fix listed CWE-862

TI-2025-41680 CVE-2025-68071 · GHSA-hjv3-73x3-fw6v

WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability

LOW 28

Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential R…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00253 Published 2025-12-16 No fix listed CWE-639

TI-2025-40652 CVE-2025-66127 · GHSA-c96r-7rrc-78hh

WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a throug…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2025-12-16 No fix listed CWE-862

TI-2025-33318 CVE-2025-53352 · GHSA-5m8r-jcr3-wj4v

WordPress Grid Plus plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Grid Plus grid-plus allows Reflected XSS.This issue affects Grid Plus: from n/a through <= 3.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0025 Published 2025-10-22 No fix listed CWE-79

TI-2025-30496 CVE-2025-48126 · GHSA-36m6-mcp9-gvc5

WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability

MEDIUM 44

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affe…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00598 Published 2025-06-09 No fix listed CWE-98

TI-2024-12459 CVE-2024-13418 · GHSA-v6f5-g4qj-mjvh

Smart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 41

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00771 Published 2025-05-02 No fix listed CWE-434

TI-2024-12461 CVE-2024-13420 · GHSA-98r7-98px-p4mx

Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates

LOW 20

Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_pres…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00242 Published 2025-05-02 No fix listed CWE-94

TI-2024-12460 CVE-2024-13419 · GHSA-hhv8-q584-2mj6

Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

LOW 28

Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versio…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00199 Published 2025-05-02 No fix listed CWE-862

TI-2025-23737 CVE-2025-32672 · GHSA-fgvp-qmxh-3qxp

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerability

LOW 39

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Ultimate Bootstrap Elements for Elementor ultimate-bootstrap-elements-for-elementor allows…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00963 Published 2025-04-11 No fix listed CWE-98

TI-2025-22119 CVE-2025-30849 · GHSA-5278-2h8h-4p7c

WordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerability

MEDIUM 44

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00827 Published 2025-04-01 No fix listed CWE-98

TI-2025-18415 CVE-2025-24698 · GHSA-g339-vh54-3m75

WordPress Essential Real Estate plugin <= 5.1.8 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in g5theme Essential Real Estate essential-real-estate allows Cross Site Request Forgery.This issue affects Essential Real Estate: from n/a through <= 5.1.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00221 Published 2025-01-24 No fix listed CWE-352

TI-2023-16881 CVE-2023-34014 · GHSA-xw29-mcqh-6v78

WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability

LOW 25

Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00447 Published 2024-12-13 No fix listed CWE-862

TI-2024-11436 CVE-2024-12329 · GHSA-9pc4-9w75-xg97

Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure

LOW 20

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0036 Published 2024-12-12 No fix listed CWE-200

TI-2024-10114 CVE-2024-10910 · GHSA-gv9r-9rwg-8w3p

Code injection in g5theme Grid Plus – Unlimited grid layout

LOW 39

The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all versions up to, and including, 1.3.5.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00599 Published 2024-12-12 No fix listed CWE-94

TI-2024-09569 CVE-2024-10329 · GHSA-88m6-45c8-3f97

Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure

LOW 20

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00414 Published 2024-11-05 No fix listed CWE-200

TI-2024-28811 CVE-2024-43140 · GHSA-xf46-hjp6-hxpp

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability

MEDIUM 41

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elem…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00582 Published 2024-08-13 No fix listed CWE-22

TI-2024-24966 CVE-2024-37462 · GHSA-66x4-xvv2-2j4j

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerability

HIGH 73

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path Traversal.This issue affects Ultimate Bootstrap Elements for E…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00575 Published 2024-07-09 No fix listed CWE-22