Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: javothemes Clear all filters
TI-2017-14766 CVE-2017-20287 · GHSA-f9g9-m55p-h787

Path traversal in Javo Spot WordPress theme lets attackers read files

Priority HIGH 77

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.007 Published 2026-10-22 Fixed in 3.0.0 CWE-22
TI-2025-35855 CVE-2025-58003 · GHSA-g4g9-vghf-h54x

WordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control Vulnerability

Priority LOW 30

Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00277 Published 2025-09-22 No fix listed CWE-862