CVE-2026-27086

WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2026-56072

WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2023-32500

WordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xtemos

Products

Woodmart

CVE-2023-32240

WordPress Woodmart theme <= 7.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Xtemos WoodMart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoodMart: from n/a through 7.2.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2023-25790

WordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injection

Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-49935

WordPress WoodMart theme < 8.3.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in xtemos WoodMart woodmart allows PHP Local File Inclusion.This issue affects WoodMart: from n/a through < 8.3.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-47600

WordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart allows Code Injection.This issue affects WoodMart: from n/a through <= 8.3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2026-23971

WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2026-32405

WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in xtemos WoodMart woodmart allows Retrieve Embedded Sensitive Data.This issue affects WoodMart: from n/a through <= 8.3.9.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-6745

WoodMart <= 8.2.5 - Unauthenticated Post Disclosure

The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-6743

WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-6746

WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-6744

Woodmart <= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution

The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_get_products_shortcode() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-8097

WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2023-32244

WordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalation

Improper Privilege Management vulnerability in xtemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Xtemos

Products

Woodmart Core

CVE-2024-12333

WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2025-49936

WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xtemos

Products

Wordpress Woodmart

CVE-2023-32242

WordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Xtemos

Products

Woodmart

CVE-2023-41872

WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Xtemos

Products

Woodmart

CVE-2023-32239

WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in xtemos WoodMart theme <= 7.2.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xtemos

Products

Woodmart Theme