purethemes Vulnerabilities and Affected Products
Vulnerabilities associated with WorkScout-Core.
Products
Clear product- WorkScout-Core5 vulnerabilities
- Listeo Core3 vulnerabilities
- Realteo3 vulnerabilities
- Findeo2 vulnerabilities
- Listeo2 vulnerabilities
- WorkScout2 vulnerabilities
- Listeo - Directory & Listings With Booking - WordPress Theme1 vulnerability
- Listeo-Core - Directory Plugin by Purethemes1 vulnerability
- Workscout Core1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-57786HIGH | WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08. CWE-352Jul 13, 2026 | CVSS8.8v3.1 | EPSS0.164% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-52716MEDIUM | WordPress WorkScout-Core plugin <= 1.7.11 - Arbitrary File Deletion vulnerabilityUnauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions. CWE-22Jun 17, 2026 | CVSS6.5v3.1 | EPSS0.34% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-67960HIGH | WordPress WorkScout-Core plugin <= 1.7.06 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06. CWE-79Jan 22, 2026 | CVSS7.1v3.1 | EPSS0.23% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-59571HIGH | WordPress WorkScout-Core plugin < 1.7.06 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06. CWE-79Oct 22, 2025 | CVSS7.1v3.1 | EPSS0.233% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-59572HIGH | WordPress WorkScout-Core Plugin < 1.7.06 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Cross Site Request Forgery.This issue affects WorkScout-Core: from n/a through < 1.7.06. CWE-352Sep 22, 2025 | CVSS8.8v3.1 | EPSS0.159% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |