Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16

Export CSV
CVE-2023-34014

WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Grid-plus Wordpress
CVE-2025-66127

WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Essential Real Estate Wordpress
CVE-2023-46209

WordPress Grid Plus Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in G5Theme Grid Plus – Unlimited grid plugin <= 1.3.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
G5theme
Products
Grid-plus
CVE-2025-68071

WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Essential Real Estate Wordpress
CVE-2026-39668

WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Book Previewer For Woocommerce Wordpress
CVE-2026-39714

WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
G5plus April Wordpress
CVE-2026-27087

WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Wolverine Framework Wordpress
CVE-2026-27088

WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Darna Framework Wordpress
CVE-2025-69096

WordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zorka: from n/a through <= 1.5.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Zorka Wordpress
CVE-2026-22520

WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Handmade Framework Wordpress
CVE-2025-53352

WordPress Grid Plus plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Grid Plus grid-plus allows Reflected XSS.This issue affects Grid Plus: from n/a through <= 3.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
G5theme Wordpress
Products
Grid-plus Wordpress
CVE-2023-5251

Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete

The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout. CVE-2023-34014 appears to be a duplicate of this issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme
Products
Grid Plus
CVE-2023-5250

Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files with arbitrary content can be uploaded and included.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
G5theme
Products
Grid Plus
CVE-2022-3933

Essential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
G5theme
Products
Essential Real Estate
CVE-2024-43140

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
G5plus G5theme
Products
Ultimate Bootstrap Elements For Elementor Ultimate Bootstrap Elements For Elementor