Vulnerabilities

TI-2025-11805 CVE-2025-12886 · GHSA-x7f7-7836-w8h5

Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path

LOW 37

The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00193 Published 2026-03-28 No fix listed CWE-918

TI-2025-42742 CVE-2025-69299 · GHSA-p95v-rww3-j83p

WordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability

LOW 37

Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6.0.8.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00219 Published 2026-02-20 No fix listed CWE-918

TI-2025-11814 CVE-2025-12895 · GHSA-gm4j-hg89-42fw

Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request

LOW 30

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2026-01-15 No fix listed CWE-862

TI-2025-33315 CVE-2025-53349 · GHSA-cxw3-8hp5-fg86

WordPress Kalium Theme <= 3.18.3 - Cross Site Scripting (XSS) Vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laborator Kalium kalium allows Reflected XSS.This issue affects Kalium: from n/a through <= 3.18.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00235 Published 2025-11-06 No fix listed CWE-79

TI-2025-31841 CVE-2025-49926 · GHSA-c6cw-fgf7-59qc

WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability

LOW 37

Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through <= 3.25.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00272 Published 2025-10-22 No fix listed CWE-94

TI-2025-33314 CVE-2025-53348 · GHSA-jh47-w4rv-5jp9

WordPress Kalium Theme <= 3.18.3 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00273 Published 2025-09-09 No fix listed CWE-862

TI-2025-33313 CVE-2025-53347 · GHSA-27g2-4mxr-gqmm

WordPress Kalium Theme <= 3.18.3 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.18.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00153 Published 2025-08-14 No fix listed CWE-352

TI-2024-11844 CVE-2024-12781 · GHSA-56w8-9358-hf89

Missing authorization in Laborator Aurum - WordPress & WooCommerce Shopping Theme

LOW 20

The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all ve…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00338 Published 2025-01-07 No fix listed CWE-862

TI-2020-14794 CVE-2020-24075 · GHSA-66cp-42qw-2cw2

Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in…

LOW 28

Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00509 Published 2023-08-11 No fix listed CWE-79

TI-2020-14602 CVE-2020-23576 · GHSA-h25r-hf7h-m6wv

Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.

LOW 25

Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00545 Published 2020-08-27 No fix listed CWE-79

TI-2020-10976 CVE-2020-14010 · GHSA-fcpw-3jcf-6h8w

The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the…

LOW 29

The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00934 Published 2020-06-10 No fix listed CWE-79

TI-2020-10871 CVE-2020-13890 · GHSA-h5pw-7qvg-2fpq

The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.

LOW 25

The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00545 Published 2020-06-06 No fix listed CWE-79

TI-2019-14519 CVE-2019-20141 · GHSA-h345-gcmh-6ppj

An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the…

LOW 35

An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.05008 Published 2019-12-30 No fix listed CWE-79

Vulnerabilities

Filters