Vulnerabilities

TI-2026-79746 CVE-2026-112863 · GHSA-qh93-25q9-m9q7

Reflected cross-site scripting in WordPress KALLYAS theme

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2026-10-23 No fix listed CWE-79

TI-2025-39209 CVE-2025-63061 · GHSA-v2w2-v8vg-2rqw

WordPress KALLYAS theme < 4.25.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hogash KALLYAS kallyas allows DOM-Based XSS.This issue affects KALLYAS: from n/a through < 4.25.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00232 Published 2025-12-09 No fix listed CWE-79

TI-2025-39208 CVE-2025-63060 · GHSA-6wwx-qhx3-qjmx

WordPress KALLYAS theme < 4.25.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in hogash KALLYAS kallyas allows Cross Site Request Forgery.This issue affects KALLYAS: from n/a through < 4.25.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00151 Published 2025-12-09 No fix listed CWE-352

TI-2025-38341 CVE-2025-62018 · GHSA-3fcj-hp8x-9h3j

WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00265 Published 2025-11-06 No fix listed CWE-862

TI-2025-38340 CVE-2025-62017 · GHSA-7328-gmrh-6ff7

WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00259 Published 2025-11-06 No fix listed CWE-862

TI-2025-38339 CVE-2025-62016 · GHSA-7fw8-429x-p2jr

WordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerability

MEDIUM 43

Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00418 Published 2025-11-06 No fix listed CWE-434

TI-2025-06356 CVE-2025-6988 · GHSA-h4p8-hmx2-hvxv

Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00193 Published 2025-11-01 No fix listed CWE-79

TI-2025-06358 CVE-2025-6990 · GHSA-2cxc-vpf5-w9j6

Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution

MEDIUM 41

The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the `TH_PhpCode` pagebuilder widget.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00585 Published 2025-11-01 No fix listed CWE-94

TI-2025-06359 CVE-2025-6991 · GHSA-44wg-wphc-x6jc

Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion

LOW 37

The kallyas theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.21.0 via the 'TH_LatestPosts4` widget.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00921 Published 2025-07-26 No fix listed CWE-98

TI-2025-06357 CVE-2025-6989 · GHSA-2pp9-v2c7-29w7

Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion

LOW 36

The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00499 Published 2025-07-26 No fix listed CWE-22

Vulnerabilities

Filters