Vulnerabilities

TI-2026-69916 CVE-2026-94159 · GHSA-2p2m-hfvx-8h9v

Stored cross-site scripting in WordPress Total Donations plugin

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-10-09 No fix listed CWE-79

TI-2026-51510 CVE-2026-73391 · GHSA-qm8v-wgj5-vhrm

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-08-19 No fix listed CWE-89

TI-2026-51509 CVE-2026-73390 · GHSA-gcmv-5j7j-qj9m

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

MEDIUM 49

Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-08-19 No fix listed CWE-266

TI-2023-26845 CVE-2023-49186 · GHSA-9wqc-j2xj-3mh2

WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00171 Published 2026-01-05 No fix listed CWE-79

TI-2023-27242 CVE-2023-49838 · GHSA-mmch-m456-f59q

Cross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbTheme

LOW 20

Cross-Site Request Forgery (CSRF) vulnerability in KlbTheme Clotya theme, KlbTheme Cosmetsy theme, KlbTheme Furnob theme, KlbTheme Bacola theme, KlbTheme Partdo theme, KlbTheme Medibazar theme, KlbTheme Machic theme.This…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00261 Published 2024-03-26 No fix listed CWE-352

TI-2023-27243 CVE-2023-49839 · GHSA-8rgx-p5cx-vq85

Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTh…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00461 Published 2024-03-26 No fix listed CWE-79