Current: English
Posts tagged Wordpress.
CVE-2025-6254 affects the Doctreat Core WordPress plugin through version 1.6.8. The vulnerability allows unauthenticated attackers to register an account with administrator privileges because the registration handler does not properly restrict the requested role.
CVE-2026-5118 affects Divi Form Builder through version 5.1.2. The vulnerability allows unauthenticated attackers to create administrator accounts by manipulating the role value accepted during public form registration.
CVE-2026-8181 affects Burst Statistics – Privacy-Friendly WordPress Analytics versions 3.4.0 through 3.4.1.1. The vulnerability is an authentication bypass that can allow an unauthenticated attacker who knows an administrator username to impersonate that administrator during a request.
CVE-2026-3584 affects the Kali Forms WordPress plugin through version 2.4.9. The vulnerability allows unauthenticated remote code execution through the form_process functionality because attacker-controlled values can reach dynamic PHP callback execution.
CVE-2025-5394 affects the Alone – Charity Multipurpose Non-profit WordPress Theme through version 7.8.3. The theme exposes a plugin-installation function without sufficient capability checks, allowing unauthenticated attackers to upload and install plugin packages from remote locations.
CVE-2025-4606 affects the Sala – Startup & SaaS WordPress Theme through version 1.1.4. The vulnerability allows unauthenticated attackers to change passwords for arbitrary users, including administrators, because the password-update functionality does not properly establish the identity of the reque...
CVE-2025-4601 affects the RH - Real Estate WordPress Theme through version 4.4.0. An authenticated user with subscriber-level access or higher can potentially manipulate their account role and escalate to administrator privileges.
The public Streamit research repository documents an authenticated arbitrary file upload vulnerability in the Streamit WordPress theme. A logged-in subscriber-level user can abuse the profile-avatar upload functionality when file-type validation is insufficient, creating a potential path to remote c...
CVE-2025-47577 affects the TI WooCommerce Wishlist WordPress plugin through version 2.9.2. The issue is an unrestricted file upload vulnerability that can allow an unauthenticated attacker to place dangerous files on a vulnerable WordPress installation, with potential for remote code execution depen...