Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: RiceTheme Clear all filters
TI-2025-17760 CVE-2025-23993 · GHSA-7h89-54x4-x67j

WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability

Priority MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <=…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00398 Published 2026-01-08 No fix listed CWE-89
TI-2025-17271 CVE-2025-23504 · GHSA-8r96-x95v-q4mh

WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability

Priority MEDIUM 49

Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00492 Published 2026-01-08 No fix listed CWE-288
TI-2025-09939 CVE-2025-10849 · GHSA-w7vf-h9wj-xgpw

Missing authorization in RiceTheme Felan Framework

Priority LOW 30

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via an AJAX action in versions up to, and incl…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00316 Published 2025-10-16 No fix listed CWE-862
TI-2025-09940 CVE-2025-10850 · GHSA-wrg3-6p86-gf29

Felan Framework <= 1.1.4 - Hardcoded Credentials

Priority MEDIUM 50

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00608 Published 2025-10-16 No fix listed CWE-798