CVE-2024-49269

WordPress my flatonica theme <= 0.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mythemes Wordpress

Products

My Flatonica Wordpress

CVE-2024-52488

WordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerability

Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Zidithemes

Products

Wordpress Grip

CVE-2025-59560

WordPress Sonaar theme <= 4.27.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sonaar Music Wordpress

Products

Sonaar Wordpress

CVE-2025-59563

WordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Sonaar Music Wordpress

Products

Sonaar Wordpress

CVE-2025-60218

WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Upload Vulnerability

Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wplocker

Products

Wordpress Pt Luxa Addons

CVE-2025-60223

WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.5 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Quantumcloud Wordpress

Products

Wpbot Pro Wordpress Chatbot Wordpress

CVE-2025-69110

WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Airsupply Wordpress

CVE-2025-69129

WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Extendons Wordpress

Products

Wordpress & Woocommerce Scraper Plugin Wordpress & Woocommerce Scraper Plugin, Import Data From Any Site Wordpress

CVE-2025-69135

WordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerability

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Curlythemes Wordpress

Products

Events Schedule - Wordpress Events Calendar Plugin Wordpress

CVE-2025-69138

WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jthemes Wordpress

Products

Genemy Wordpress

CVE-2025-69161

WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Snowy Wordpress

CVE-2025-69171

WordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themerex Wordpress

Products

Orpheus Wordpress

CVE-2025-69179

WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Theme Passion Wordpress

Products

Support Ticket Management System Wordpress

CVE-2026-22327

WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Zozothemes

Products

Wordpress Restaurt

CVE-2026-22328

WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vamtam Wordpress

Products

Auto Repair Wordpress

CVE-2026-22329

WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress

Products

Skillate Wordpress

CVE-2026-22334

WordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpos

Products

Wordpress Woocommerce Book Price

CVE-2026-22335

WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wc Lovers. Wordpress

Products

Woocommerce Frontend Manager – Ultimate Wordpress

CVE-2026-22339

WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jobster Marketplace Wordpress

Products

Wpjobster Wordpress

CVE-2026-22342

WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Premiumpress Limited. Wordpress

Products

Wordpress Dating Theme Wordpress