| Altair Theme |
Unauthenticated Options Update (BAC) from pp_import_current |
| AuraMart Theme |
Cross-Site Scripting (XSS) |
| Big Store Theme |
Broken Access Control (BAC) |
| BoomBox Theme Extensions |
Privilege Escalation (BAC) from Password Reset/Account Takeover (BAC) in boombox_ajax_reset_password |
| Build Theme |
Cross-Site Scripting (XSS) |
| Churel Theme |
Cross-Site Scripting (XSS) |
| City Store Theme |
Cross-Site Scripting (XSS) |
| Civi Theme |
Authentication Bypass (BAC) from Non-Randomized Password for SSO Accounts |
| Civi Theme |
Authentication Bypass (BAC) from Password Update |
| Civi Theme |
Private Information Exposure |
| CozyStay Theme |
Missing Authorization (BAC) to Action Execution (BAC) in ajax_handler |
| CozyStay Theme |
PHP Object Injection (RCE) |
| Design Comuni Italia Theme |
Unauthenticated Cross-Site Scripting (XSS) |
| DesignThemes Core Features |
Missing Authorization (BAC) to Unauthenticated File Read (BAC) from dt_process_imported_file |
| DesignThemes Core Features |
Cross-Site Scripting (XSS) from Shortcode |
| DethemeKit For Elementor |
Cross-Site Scripting (XSS) |
| Domain Theme |
Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS) |
| WordPress Eco Nature - Environment & Ecology WordPress theme |
Missing Authorization (BAC) to Limited Options Update (BAC) |
| Flex Mag Theme |
Missing Authorization (BAC) to Option Deletion (BAC) |
| Golo Theme |
Missing Authorization (BAC) to Privilege Escalation (BAC) from Unauthenticated User Password Change |
| Hester Theme |
Cross-Site Scripting (XSS) |
| Homey Theme |
Unauthenticated Privilege Escalation (BAC) in homey_save_profile |
| Homey Theme |
Cross-Site Request Forgery (CSRF) and User Verification |
| Homey Theme |
Limited Authentication Bypass (BAC) due to Missing Empty Value Check |
| Industrial Theme |
Missing Authorization (BAC) to Options Update (BAC) |
| JNews Theme |
Unauthorized User Registration |
| JobCareer Theme |
Missing Authorization (BAC) to Multiple Administrative Actions |
| Lafka Theme |
Missing Authorization (BAC) to Demo Import |
| Listingo Theme |
Unauthenticated Shortcode Execution (BAC) |
| MinimogWP Theme |
Unauthenticated Local PHP File Inclusion (LFi) |
| Mobile Themes |
Cross-Site Request Forgery (CSRF) |
| MorningTime Lite Theme |
Cross-Site Scripting (XSS)Remote Code Execution (BAC) |
| Newscrunch Theme |
File Upload (BAC) |
| Newscrunch Theme |
Cross-Site Request Forgery (CSRF) and File Upload (BAC) |
| newseqo Theme |
Cross-Site Scripting (XSS) |
| RainbowNews Theme |
Cross-Site Scripting (XSS) |
| RomethemeKit For Elementor |
Plugin Installation/Activation (BAC) to Remote Code Execution (RCE) |
| Shortcodes by United Themes |
Unauthenticated Shortcode Execution (BAC) |
| Sparkling Theme |
Missing Authorization (BAC) to Unauthenticated Plugin Activation/Deactivation (BAC) (BAC) |
| StoreBiz Theme |
Cross-Site Scripting (XSS) |
| Theme Demo Bar |
Cross-Site Scripting (XSS) |
| ThemeEgg ToolKit |
File Upload (BAC) |
| TinySalt Theme |
PHP Object Injection (RCE) |
| Traveler Theme |
Broken Access Control (BAC) |
| Traveler Theme |
Broken Access Control (BAC) |
| Traveler Theme |
PHP Object Injection (RCE) |
| Traveler Theme |
Cross-Site Scripting (XSS) |
| Traveler Theme |
SQL Injection (SQLi) |
| Traveler Theme |
Unauthenticated Local File Inclusion (LFi) from hotel_alone_load_more_post |
| Unlimited Theme |
Cross-Site Scripting (XSS) |
| VEDA Theme |
PHP Object Injection (RCE) |
| VW Storefront Theme |
Missing Authorization (BAC) to Settings Reset |
| Whitish Lite Theme |
Cross-Site Scripting (XSS) |
| Workreap Theme |
Unauthenticated Privilege Escalation (BAC) from Account Takeover (BAC) |
| WP Weixin Theme |
Cross-Site Scripting (XSS) |
| Zass Theme |
Missing Authorization (BAC) to Demo Import |
| Zegen Theme |
Missing Authorization (BAC) to Theme Options Update (BAC)s |
