Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: ThemeKalia Clear all filters
TI-2024-10764 CVE-2024-11617 · GHSA-c5jj-9wj5-5cv4

Envolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file

Priority MEDIUM 52

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpload' and 'zetra_fontsUpload' functions in all versions up to, and including, 1.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01433 Published 2025-05-09 No fix listed CWE-434
TI-2024-10762 CVE-2024-11615 · GHSA-hcf7-pvq8-wh55

Envolve Plugin <= 1.0 - Unauthenticated Language File Deletion

Priority LOW 30

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' and 'zetra_deleteFontsFile' functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00425 Published 2025-05-05 No fix listed CWE-22