Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 50

Export CSV
CVE-2026-95592

WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress-extensions
Products
Team Team
CVE-2026-15985

Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Classified Listing - Mobile Number Verification Wordpress
CVE-2022-50947

WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS

WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject JavaScript payloads through the testimonial title field that execute in the browsers of users viewing the draft post, enabling cookie theft and session hijacking.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Testimonial Slider And Showcase Wordpress
CVE-2026-32396

WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Team Wordpress
CVE-2026-25344

WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Review Schema Wordpress
CVE-2026-25026

WordPress Team plugin <= 5.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Team Wordpress
CVE-2025-58601

WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Classified Listing Wordpress
CVE-2025-57975

WordPress Team Plugin <= 5.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Team Wordpress
CVE-2025-54698

WordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection Vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing classified-listing allows Code Injection.This issue affects Classified Listing: from n/a through <= 5.0.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Classified Listing Wordpress
CVE-2025-53565

WordPress Widget for Google Reviews <= 1.0.15 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews business-reviews-wp allows PHP Local File Inclusion.This issue affects Widget for Google Reviews: from n/a through <= 1.0.15.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Widget For Google Reviews Wordpress
CVE-2025-30814

WordPress The Post Grid plugin <= 7.7.17 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid the-post-grid allows PHP Local File Inclusion.This issue affects The Post Grid: from n/a through <= 7.7.17.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
The Post Grid Wordpress
CVE-2025-24745

WordPress Classified Listing plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Classified Listing classified-listing allows Reflected XSS.This issue affects Classified Listing: from n/a through <= 4.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Radiustheme Wordpress
Products
Classified Listing Wordpress
CVE-2024-37520

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 2.1.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme
Products
Shopbuilder