Vulnerabilities

TI-2026-54460 CVE-2026-78289 · GHSA-vrvm-8j23-25p4

WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-27 No fix listed CWE-79

TI-2025-41604 CVE-2025-67995 · GHSA-jjpv-2mhh-mcmm

WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00606 Published 2026-02-20 No fix listed CWE-502

TI-2025-41601 CVE-2025-67992 · GHSA-7gx4-4vpm-w576

WordPress PatioTime theme < 2.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean PatioTime patiotime allows PHP Local File Inclusion.This issue affects PatioTime: from n/…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00583 Published 2026-02-20 No fix listed CWE-98

TI-2025-41597 CVE-2025-67988 · GHSA-f3xp-j3c9-999x

WordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a t…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00625 Published 2026-02-20 No fix listed CWE-98

TI-2025-31534 CVE-2025-49508 · GHSA-x9q3-23xm-57hv

WordPress CozyStay theme < 1.7.1 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a t…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00582 Published 2025-06-17 No fix listed CWE-98

TI-2025-31502 CVE-2025-49454 · GHSA-7c9g-m69r-456f

WordPress TinySalt theme < 3.10.0 - Local File Inclusion vulnerability

LOW 39

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a t…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00821 Published 2025-06-10 No fix listed CWE-98

TI-2025-31533 CVE-2025-49507 · GHSA-77r3-7jcc-r6rj

WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00623 Published 2025-06-10 No fix listed CWE-502

TI-2024-12454 CVE-2024-13412 · GHSA-887h-463q-mr2p

CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler

LOW 39

The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 1.7.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00321 Published 2025-03-19 No fix listed CWE-862

TI-2024-12452 CVE-2024-13410 · GHSA-4xcv-3vp9-9j9h

CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler

MEDIUM 50

The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to, and including 3.9.0, respectively, via deserialization of unt…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00774 Published 2025-03-19 No fix listed CWE-502

Vulnerabilities

Filters