CVE-2025-62018
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.
Risk Assessment
The risk is the possibility of unauthorized access to theme functions, which could lead to data breaches or unauthorized changes.
Recommendation
It is recommended to update the theme to a version newer than 4.22.0 and review permission configurations.
Other vulnerabilities in KALLYAS
See all- CVE-2025-63061Medium
The KALLYAS theme (versions below 4.25.0) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
- CVE-2025-63060Medium
The KALLYAS plugin (by hogash) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects KALLYAS versions from n/a through < 4.25.0.
- CVE-2025-62017Medium
The KALLYAS theme for WordPress is vulnerable to missing authorization in versions up to and including 4.22.0. This vulnerability may allow unauthorized access to functions or data.
Original NVD description (English source)
Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS