homepage

CVE-2020-15364
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Ver mais

CVE-2020-15363
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
Ver mais

TownHub - FLL-5604582D
Não autenticado refletiu a vulnerabilidade de scripts de local (XSS) descoberta por m0ze (vlλd vξctor) no Tema Prêmio WordPress Townhub (versões <= 1.2.9).
Ver mais

Traveler - FLL-C625FAD8
Vulnerabilidade não autenticada refletida de scripts (XSS) encontrada pelo VLAD Vector no Tema de Reserva de Viagens WordPress (versões <= 2.8.1).
Ver mais

CityBook - FLL-51826907
Vulnerabilidade não autenticada refletida de scripts (XSS) encontrada pelo vetor de Vlad em WordPress Citybook Theme Premium (versões <= 2.4.3).
Ver mais

CVE-2020-4049
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Ver mais

CVE-2020-14010
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
Ver mais

Newspaper - FLL-1DC0143F
A autenticada refletiu a vulnerabilidade de scripts transversais (XSS) descoberta por Julio Powerier (Secupress) no tema do WordPress Jornal Premium (versões <= 10.3.3).
Ver mais

Careerfy - FLL-B76011F8
Não autenticado refletiu a vulnerabilidade de scripts de local (XSS) descoberta por Daniel Ruf no tema do WordPress Careerfy Premium (versões <= 3.8.0).
Ver mais

Avada - FLL-DFAEE0D1
Vulnerabilidade arbitrária da criação, edição e exclusão de postagem descoberta pelo Nintechnet no tema Premium do WordPress AVADA (versões <= 6.2.2).
Ver mais

Avada - FLL-8345574C
Vulnerabilidade armazenada de scripts de localização (XSS) descoberta pelo Nintechnet no Tema Premium do WordPress Avada (versões <= 6.2.2).
Ver mais

CVE-2019-17230
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Ver mais

CVE-2019-17231
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Ver mais

Fruitful - FLL-78755E6A
A autenticada armazenou a vulnerabilidade de scripts transversais (XSS) descoberta pelo NinteChnet no Tema Frutífero do WordPress (versões <= 3.8.1).
Ver mais

Fruitful - FLL-2C0C94D1
Não autenticado refletiu a vulnerabilidade de scripts de localização cruzada (XSS) descoberta por Behzad Khalifeh e Milad Ranjbar no Tema Frutífero do WordPress (versões <= 3,8).
Ver mais

Reality - FLL-9192FEF3
Não autenticado refletiu a vulnerabilidade de scripts de localização cruzada (XSS) encontrada por m0ze no tema do WordPress Reality Premium (versões <= 2.5.1).
Ver mais

Houzez - FLL-6D1C7112
Vulnerabilidade não autenticada de scripts (XSS) encontradas por M0ze no tema WordPress Houzez (versões <= 1.8.3).
Ver mais

CarSpot - FLL-185E637B
Vulnerabilidade autenticada de scripts transversais persistidas (XSS) descoberta por m0ze no tema Premium do WordPress Carspot (versões <= 2.2.2).
Ver mais

CarSpot - FLL-F9D0591B
Vulnerabilidade autenticada de scripts de sites transversais persistidos (XSS) de vulnerabilidade (anúncio post) descoberta por m0ze no tema do WordPress Carspot Premium (versões <= 2.2.2).
Ver mais

CarSpot - FLL-A9A855C8
Vulnerabilidades múltiplas (autenticadas persistentes XSS & IDOR) encontradas por m0ze no tema do WordPress Carspot (versões <= 2.2.0).
Ver mais

CarSpot - FLL-3837C64D
Vulnerabilidade de Referências de Objeto Direto Inseguro (IDOR) Descoberta por M0ZE no Tema Premium do WordPress Carspot (versões <= 2.2.2).
Ver mais

CVE-2013-0286
Pinboard 1.0.6 theme for WordPress has XSS.
Ver mais

ListingPro - FLL-0519D95B
Não autenticada refletiu a vulnerabilidade de scripts (XSS) descoberta por m0ze no tema do WordPress ListingPro Premium (versões <= 2.5.3).
Ver mais

Real Estate 7 - FLL-5D0232F5
Vulnerabilidade não autenticada de scripts de local (XSS) descoberta por m0ze no Tema Premium do WordPress Real Estate 7 (versões <= 2.9.4).
Ver mais

Real Estate 7 - FLL-3E94EAD1
Vulnerabilidade sensível à divulgação de informações descobertas por m0ze no tema do WordPress Real Imobiliário 7 (versões <= 2.9.4).
Ver mais

Real Estate 7 - FLL-8FCA061D
Vulnerabilidade de Scripts de Site Cross-Site Persistente (XSS) descoberta por m0ze no tema do WordPress Real Imobiliário 7 (versões <= 2.9.4).
Ver mais

Real Estate 7 - FLL-1F0555D2
Vulnerabilidade de referências de objeto direto inseguro (IDOR) descoberta por m0ze no tema do WordPress Real Imobiliário 7 (versões <= 2.9.4).
Ver mais

Real Estate 7 - FLL-DB7026DF
Vulnerabilidade autenticada persistente de scripts (xss) descoberta por m0ze no tema Premium do WordPress Real Estate 7 (versões <= 2.9.4).
Ver mais

Traveler - FLL-05F31A86
Vulnerabilidades refletidas e persistentes de scripts (XSS) encontradas por M0ze no Tema de Reserva de Viagem do WordPress (versões <= 2.7.8.5).
Ver mais

CVE-2019-20210
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
Ver mais

CVE-2019-20211
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.
Ver mais

CVE-2019-20212
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
Ver mais

CVE-2019-20209
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
Ver mais

Divi - FLL-731AD2DC
Vulnerabilidade de injeção de código autenticado encontrada no tema do WordPress Divi Premium (versões <= 4.0.9).
Ver mais

Extra - FLL-015ECC95
Vulnerabilidade de Injeção de Código Autenticada encontrada no Tema Premium do WordPress (Versões <= 4.0.9).
Ver mais

TownHub - FLL-E8DC087D
Vulnerabilidade autenticada de scripts transversais persistidas (XSS) descoberta por m0ze no tema WordPress Townhub Premium (versões <= 1.0.5).
Ver mais

TownHub - FLL-32858F2A
Vulnerabilidade não autenticada de scripts de localização (XSS) encontrada por m0ze no tema Premium WordPress Townhub (versões <= 1.0.5).
Ver mais

CVE-2019-20141
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
Ver mais

CVE-2019-19541
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.
Ver mais

CVE-2019-19540
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
Ver mais

CVE-2019-19542
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.
Ver mais

ListingPro - FLL-D2880825
Vulnerabilidade refletida e persistente de scripts (XSS) encontradas pela Subvrsλ no tema do WordPress ListingPro Premium (versões <= 2.0.14.2).
Ver mais

Superlist - FLL-6745F9EA
Vulnerabilidade persistente de scripts (XSS) encontradas pelo Subvrsλ no tema Premium do WordPress Superlist (versões <= 2.9.2).
Ver mais

Materialis - FLL-24311AD4
Opções autenticadas Atualizar vulnerability encontrada pelo Nintechnet no tema WordPress Materialis (versões <= 1.0.172).
Ver mais

Mesmerize - FLL-3133BEF2
Vulnerabilidade de Atualização de Opções autenticadas encontradas pelo Nintechnet no tema do WordPress Mesmerize (versões <= 1.6.89).
Ver mais

CVE-2015-9504
The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
Ver mais

CVE-2015-9502
The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
Ver mais

CVE-2015-9503
The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
Ver mais

CVE-2015-9536
The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Ver mais

CVE-2015-9535
The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Ver mais

CVE-2015-9534
The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Ver mais

CVE-2015-9533
The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Ver mais

CVE-2015-9532
The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Ver mais

CVE-2015-9501
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
Ver mais

CVE-2015-9486
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9492
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9487
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9489
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9491
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9490
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9484
The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9481
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9482
The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Ver mais

CVE-2015-9474
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
Ver mais

CVE-2015-9475
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
Ver mais

CVE-2015-9473
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.
Ver mais

CVE-2015-9476
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.
Ver mais

CVE-2015-9477
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
Ver mais

Zoner - Real Estate - FLL-3B98F901
Vulnerabilidade persistente de scripts (xss) persistentes encontradas pelo VLAD Vector (EX.MI) no WordPress Zoner - Tema Premium Imobiliário (versões <= 4.1.1).
Ver mais

Zoner - Real Estate - FLL-DCE9F2A0
Vulnerabilidade de Referências de Objeto Direto Inseguro (IDOR) encontrada pelo Vector VLAD (EX.MI) no WordPress Zoner - Tema Premium Imobiliário (versões <= 4.1.1).
Ver mais

CVE-2015-9406
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Ver mais

CVE-2014-10396
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
Ver mais

CVE-2014-10397
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
Ver mais

CVE-2016-11002
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
Ver mais

CVE-2016-10999
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
Ver mais

CVE-2016-10997
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
Ver mais

CVE-2016-10994
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
Ver mais

CVE-2016-10993
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
Ver mais

CVE-2016-10972
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
Ver mais

CVE-2016-10957
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
Ver mais

CVE-2016-10961
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
Ver mais

CVE-2017-18634
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
Ver mais

CVE-2016-10954
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
Ver mais

CVE-2016-10953
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
Ver mais

CVE-2016-10945
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
Ver mais

CVE-2017-18607
The avada theme before 5.1.5 for WordPress has CSRF.
Ver mais

CVE-2017-18606
The avada theme before 5.1.5 for WordPress has stored XSS.
Ver mais

CVE-2017-18599
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
Ver mais

CVE-2018-21013
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
Ver mais

CVE-2019-15870
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Ver mais

CVE-2019-15869
The JobCareer theme before 2.5.1 for WordPress has stored XSS.
Ver mais

Real Estate 7 - FLL-C9544D70
Vulnerabilidade armazenada de scripts de localização (XSS) encontrada por M0ZE no plug-in do WordPress Real Estate 7 (versões <= 2.9.0).
Ver mais

Real Estate 7 - FLL-9689F872
Vulnerabilidade de referência de objeto direto insegura encontrada por m0ze no plugin do WordPress Real Estate 7 (versões <= 2.9.0).
Ver mais

CVE-2019-1010124
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
Ver mais

Zoner - Real Estate - FLL-1D4381C0
Vulnerabilidade refletida e armazenada de scripts (xss) encontradas por Quixss no WordPress Zoner - Tema Premium Imobiliário (versões <= 4.1).
Ver mais

JobCareer - FLL-50599B12
Vulnerabilidade armazenada com scripts (XSS) encontradas por Quixss no tema WordPress JobCareer (versão 2.5).
Ver mais

Traveler - FLL-11209043
Refletido e armazenado Cross-Site Scripting XSS Vulnerability encontrado por Quixss no WordPress Traveler - Tema de reservas de viagens (versões <= 2.7.1).
Ver mais

Traveler - FLL-CA743611
Vulnerabilidades refletidas e armazenadas de scripts (XSS) encontradas por Quixss no Tema de Reserva de Viagem do WordPress (versões <= 2.7.8.3).
Ver mais

CarSpot - FLL-D2885939
Vulnerabilidade autenticada armazenada de scripts (XSS) encontrada por Quixss no tema do WordPress Carspot (versões <= 2.1.6).
Ver mais

Newspaper - FLL-1DEC15EE
Vulnerabilidade de scripts (XSS) transversais encontradas no tema do WordPress Jornal (versões <= 9.2.2).
Ver mais