Vulnerabilities

TI-2025-37596 CVE-2025-60230 · GHSA-w726-m5f9-394j

WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00426 Published 2026-06-17 No fix listed CWE-502

TI-2025-37595 CVE-2025-60229 · GHSA-7ggh-p7v4-mmgg

WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00426 Published 2026-06-17 No fix listed CWE-502

TI-2025-37603 CVE-2025-60237 · GHSA-rp47-333h-6hmq

WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00531 Published 2026-03-19 No fix listed CWE-502

TI-2025-37599 CVE-2025-60233 · GHSA-ppmc-4vgv-73hc

WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00409 Published 2026-03-19 No fix listed CWE-502

TI-2025-41360 CVE-2025-67617 · GHSA-94gj-3qj6-w8qv

WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00802 Published 2026-01-22 No fix listed CWE-502

TI-2025-22337 CVE-2025-31067 · GHSA-c22w-q6wf-4ggw

WordPress Seven Stars theme <= 1.4.4 - Cross Site Scripting (XSS) Vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Seven Stars allows Stored XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0026 Published 2025-06-27 No fix listed CWE-79

TI-2025-23056 CVE-2025-31919 · GHSA-m6jx-4j6j-qjq9

WordPress Spare <= 1.7 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00541 Published 2025-06-17 No fix listed CWE-502

TI-2025-22322 CVE-2025-31052 · GHSA-g6wg-65ph-qqg4

Deserialization of untrusted data in themeton The Fashion - Model Agency One Page Beauty…

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00598 Published 2025-06-09 No fix listed CWE-502

TI-2025-22577 CVE-2025-31396 · GHSA-9x2r-jx6p-6xv9

WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-06-09 No fix listed CWE-502

TI-2025-22579 CVE-2025-31398 · GHSA-cq9h-95xf-3p42

WordPress PIMP - Creative MultiPurpose <= 1.7 - Deserialization of untrusted data Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-06-09 No fix listed CWE-502

TI-2025-22610 CVE-2025-31429 · GHSA-f4c7-2696-h4vc

Deserialization of untrusted data in themeton PressGrid - Frontend Publish Reaction &…

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-06-09 No fix listed CWE-502

TI-2025-22801 CVE-2025-31638 · GHSA-gr9x-pxfv-7mgh

WordPress Spare <= 1.7 - Cross Site Scripting (XSS) Vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00288 Published 2025-06-09 No fix listed CWE-79

TI-2025-22319 CVE-2025-31049 · GHSA-25wq-m5r4-rrm3

WordPress Dash <= 1.3 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-05-23 No fix listed CWE-502

TI-2025-22339 CVE-2025-31069 · GHSA-2rcx-2829-7fg5

WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-05-23 No fix listed CWE-502

TI-2025-22611 CVE-2025-31430 · GHSA-v7cm-mpcm-37f9

WordPress The Business <= 1.6.1 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-05-23 No fix listed CWE-502

TI-2025-23064 CVE-2025-31927 · GHSA-3grc-cj2m-fpc6

WordPress Acerola <= 1.6.5 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-05-23 No fix listed CWE-502

TI-2025-22335 CVE-2025-31065 · GHSA-97qr-gc42-m9f7

WordPress Rozario <= 1.4 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2025-05-16 No fix listed CWE-862

TI-2025-22336 CVE-2025-31066 · GHSA-j869-cw6m-fwm6

WordPress Acerola theme <= 1.6.5 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00426 Published 2025-05-16 No fix listed CWE-862

TI-2025-22338 CVE-2025-31068 · GHSA-phr9-hmp9-rhqp

WordPress Seven Stars <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00205 Published 2025-05-16 No fix listed CWE-352

TI-2025-22341 CVE-2025-31071 · GHSA-347j-34g4-w8rf

WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2025-05-16 No fix listed CWE-862

TI-2025-22793 CVE-2025-31630 · GHSA-64wr-jqr8-4q27

WordPress The Business <= 1.6.1 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00334 Published 2025-05-16 No fix listed CWE-862

TI-2025-22802 CVE-2025-31639 · GHSA-7whp-5ffj-6crj

WordPress Spare <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00205 Published 2025-05-16 No fix listed CWE-352

Vulnerabilities

Filters