Vulnerabilities

TI-2026-13382 CVE-2026-15980 · GHSA-6hcx-8gm4-gx5h

MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

MEDIUM 50

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00683 Published 2026-08-30 No fix listed CWE-289

TI-2026-47325 CVE-2026-66654 · GHSA-jm29-w8w6-qv96

WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

LOW 26

Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

CVSS 3.1MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00205 Published 2026-08-13 No fix listed CWE-918

TI-2025-41566 CVE-2025-67957 · GHSA-c3jv-qqqq-j4r2

WordPress Listivo Core plugin <= 2.3.77 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Cor…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00605 Published 2026-01-22 No fix listed CWE-98

TI-2025-41564 CVE-2025-67955 · GHSA-4744-8g3m-8hgr

WordPress MyHome Core plugin <= 4.1.0 - Local File Inclusion vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File Inclusion.This issue affects MyHome Core:…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00556 Published 2026-01-22 No fix listed CWE-98

TI-2025-37483 CVE-2025-60117 · GHSA-pj49-xgxg-fgg4

WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0014 Published 2025-09-26 No fix listed CWE-352

TI-2025-02711 CVE-2025-3105 · GHSA-7qfp-f29r-cqpr

Vehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation

MEDIUM 40

The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00395 Published 2025-04-04 No fix listed CWE-269

TI-2024-12888 CVE-2024-13867 · GHSA-c9ph-vw97-ph4w

Listivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting

LOW 27

The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0028 Published 2025-02-13 No fix listed CWE-79