Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2024-51800

WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Homey Wordpress
CVE-2025-67965

WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Homey Wordpress
CVE-2025-52834

WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Homey Wordpress
CVE-2025-31037

WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Homey Wordpress
CVE-2025-1327

Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion

The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's accounts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Favethemes
Products
Homey
CVE-2025-1326

Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Favethemes
Products
Homey
CVE-2025-67964

WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Homey Wordpress