CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
The Armania theme for WordPress has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 1.4.8.
The WordPress theme TechOne (techone) by kutethemes has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection and affects versions up to and including 3.0.3.
The Biolife WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.3.
The Education Base theme for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.0.8.
The Download Attachments plugin for WordPress has an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.4.0.
The KuteShop WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.2.9.
The WpXmas-Snow plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.1.
The Wava Payment WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.3.7.
The iPOSpays Gateways WC plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.7.
The BizReview theme for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.5.13.
The Super Custom Login WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.1.
The Grand Photography WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated administrator.
The Order Tracking plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.4.3.
The NM Gift Registry and Wishlist Lite plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 5.13.
The WordPress plugin RepairBuddy (computer-repair-shop) by Ateeq Rafeeq has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 4.1132.
The Booktics WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.16.
The Bus Ticket Booking with Seat Reservation plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
The WordPress plugin Instantio (instantio) by Themefic has a vulnerability that exposes sensitive system information to unauthorized control spheres, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.3.30.
The WordPress plugin 12 Step Meeting List (12-step-meeting-list) by AA Web Servant has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.19.9.
The 12 Step Meeting List plugin for WordPress up to version 3.19.9 lacks authorization, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to features.