Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: sparklewpthemes Clear all filters
TI-2026-20512 CVE-2026-25394 · GHSA-qmpj-cvwj-r2m8

WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-02-19 No fix listed CWE-862
TI-2026-20511 CVE-2026-25393 · GHSA-crp6-q5v9-wvvp

WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-02-19 No fix listed CWE-862
TI-2025-39108 CVE-2025-62960 · GHSA-wg3x-5xwq-px67

WordPress Construction Light theme <= 1.6.7 - Broken Access Control vulnerability

Priority LOW 24

Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Light: from n/a through…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00202 Published 2025-12-18 No fix listed CWE-862
TI-2025-39109 CVE-2025-62961 · GHSA-qgp3-f57g-9m42

WordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerability

Priority LOW 24

Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sparkle FSE: from n/a through <= 1.0.9.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00202 Published 2025-12-18 No fix listed CWE-862
TI-2025-06420 CVE-2025-7058 · GHSA-hpq3-v9qj-7ww6

Kingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter

Priority LOW 28

The Kingcabs theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00216 Published 2025-12-13 No fix listed CWE-79
TI-2025-34443 CVE-2025-54680 · GHSA-wg44-76jc-mh5g

WordPress Blogger Buzz Theme theme <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through <= 1.2.6…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00228 Published 2025-08-14 No fix listed CWE-79
TI-2025-05027 CVE-2025-5587 · GHSA-5pvw-cg3j-8fx4

Appzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter

Priority LOW 28

The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00357 Published 2025-07-29 No fix listed CWE-79
TI-2025-04969 CVE-2025-5529 · GHSA-54q3-26rg-jw7x

Educenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00332 Published 2025-07-26 No fix listed CWE-79
TI-2025-31885 CVE-2025-49970 · GHSA-g77f-ww54-vrfp

WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Priority LOW 20

Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00259 Published 2025-06-20 No fix listed CWE-862
TI-2025-31943 CVE-2025-50030 · GHSA-7xf3-8r2j-2pmf

WordPress Spark Multipurpose theme <= 1.0.7 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00251 Published 2025-06-20 No fix listed CWE-79
TI-2025-31946 CVE-2025-50033 · GHSA-c3xx-m76p-4r88

WordPress Fitness Park theme <= 1.1.1 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through <= 1.…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00251 Published 2025-06-20 No fix listed CWE-79