CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 21 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

CWE-79Jun 26, 2026
CVSS7.1v3.1EPSS0.175%PoCs0SignalsSTIX

WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

CWE-98Jun 17, 2026
CVSS8.1v3.1EPSS0.338%PoCs0SignalsSTIX

WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.

CWE-502Mar 25, 2026
CVSS8.1v3.1EPSS0.308%PoCs0SignalsSTIX

WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in xtemos WoodMart woodmart allows Retrieve Embedded Sensitive Data.This issue affects WoodMart: from n/a through <= 8.3.9.

CWE-497Mar 13, 2026
CVSS5.3v3.1EPSS0.24%PoCs0SignalsSTIX

WordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart allows Code Injection.This issue affects WoodMart: from n/a through <= 8.3.7.

CWE-80Jan 22, 2026
CVSS5.3v3.1EPSS0.336%PoCs0SignalsSTIX

WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.

CWE-862Dec 9, 2025
CVSS5.3v3.1EPSS0.241%PoCs0SignalsSTIX

WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.

CWE-79Oct 22, 2025
CVSS6.5v3.1EPSS0.202%PoCs0SignalsSTIX

WordPress WoodMart theme < 8.3.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in xtemos WoodMart woodmart allows PHP Local File Inclusion.This issue affects WoodMart: from n/a through < 8.3.2.

CWE-98Oct 22, 2025
CVSS7.5v3.1EPSS0.445%PoCs0SignalsSTIX

WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requireme…

CWE-20Jul 26, 2025
CVSS5.3v3.1EPSS0.319%PoCs0SignalsSTIX

WoodMart <= 8.2.5 - Unauthenticated Post Disclosure

The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

CWE-200Jul 11, 2025
CVSS5.3v3.1EPSS0.259%PoCs0SignalsSTIX

Woodmart <= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution

The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_get_products_shortcode() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CWE-94Jul 8, 2025
CVSS7.3v3.1EPSS0.42%PoCs0SignalsSTIX

WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

CWE-98Jul 8, 2025
CVSS8.8v3.1EPSS0.481%PoCs0SignalsSTIX

WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE-79Jul 8, 2025
CVSS6.4v3.1EPSS0.174%PoCs0SignalsSTIX

WordPress Woodmart theme <= 7.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Xtemos WoodMart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoodMart: from n/a through 7.2.1.

CWE-862Jan 2, 2025
CVSS5.4v3.1EPSS0.276%PoCs0SignalsSTIX

WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CWE-94Dec 12, 2024
CVSS6.5v3.1EPSS0.37%PoCs0SignalsSTIX

WordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalation

Improper Privilege Management vulnerability in xtemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.

CWE-269May 17, 2024
CVSS9.8v3.1EPSS0.789%PoCs0SignalsSTIX

WordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injection

Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.

CWE-287CWE-79Apr 24, 2024
CVSS5.3v3.1EPSS0.523%PoCs0SignalsSTIX

WordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.

CWE-502Dec 21, 2023
CVSS9.8v3.1EPSS0.798%PoCs0SignalsSTIX

WordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions.

CWE-352Nov 9, 2023
CVSS5.4v3.1EPSS0.272%PoCs0SignalsSTIX

WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions.

CWE-79Sep 25, 2023
CVSS7.1v3.1EPSS0.331%PoCs0SignalsSTIX

WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in xtemos WoodMart theme <= 7.2.1 versions.

CWE-79Jun 22, 2023
CVSS5.4v3.1EPSS0.361%PoCs0SignalsSTIX