CVE-2025-30996

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-30996", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-03-26T09:22:48.161Z", "datePublished": "2026-01-06T20:56:29.336Z", "dateUpdated": "2026-04-28T16:12:03.361Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Themify Sidepane WordPress Theme", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.8", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Themify Newsy", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Themify Folo", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.6", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Themify Edmin", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Bloggie", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.8", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Photobox", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Wigi", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Rezo", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.7", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Slide", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.7.5", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.<p>This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.</p>"}], "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5."}], "impacts": [{"capecId": "CAPEC-650", "descriptions": [{"lang": "en", "value": "CAPEC-650 Upload a Web Shell to a Web Server"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:12:03.361Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/sidepane/vulnerability/wordpress-themify-sidepane-wordpress-theme-1-9-8-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/folo/vulnerability/wordpress-themify-folo-1-9-6-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/edmin/vulnerability/wordpress-themify-edmin-2-0-0-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/bloggie/vulnerability/wordpress-bloggie-2-0-8-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/photobox/vulnerability/wordpress-photobox-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/wigi/vulnerability/wordpress-wigi-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/rezo/vulnerability/wordpress-rezo-1-9-7-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/slide/vulnerability/wordpress-slide-1-7-5-arbitrary-file-upload-vulnerability?_s_id=cve"}], "source": {"discovery": "EXTERNAL"}, "title": "Arbitrary File Upload Vulnerability in WordPress themes by Themify", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T21:04:53.034028Z", "id": "CVE-2025-30996", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T21:05:12.393Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-30996", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-06T21:04:53.034028Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T21:05:03.159Z"}}], "cna": {"title": "WordPress Themify Newsy <= 1.9.9 - Arbitrary File Upload Vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-650", "descriptions": [{"lang": "en", "value": "Upload a Web Shell to a Web Server"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Themify", "product": "Themify Newsy", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.9.9"}], "packageName": "newsy", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:22:09.762Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Newsy newsy allows Upload a Web Shell to a Web Server.This issue affects Themify Newsy: from n/a through <= 1.9.9.", "supportingMedia": [{"type": "text/html", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Newsy newsy allows Upload a Web Shell to a Web Server.<p>This issue affects Themify Newsy: from n/a through <= 1.9.9.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:07:24.951Z"}}}, "cveMetadata": {"cveId": "CVE-2025-30996", "state": "PUBLISHED", "dateUpdated": "2026-04-23T14:07:24.951Z", "dateReserved": "2025-03-26T09:22:48.161Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-06T20:56:29.336Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Themify Sidepane WordPress Theme", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.8", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Themify Newsy", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Themify Folo", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.6", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Themify Edmin", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Bloggie", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.8", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Photobox", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Wigi", "vendor": "Themify", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Rezo", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.9.7", "status": "affected", "version": "n/a", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Slide", "vendor": "Themify", "versions": [{"lessThanOrEqual": "1.7.5", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5."}, {"lang": "es", "value": "Vulnerabilidad de carga irrestricta de archivo con tipo peligroso en el tema de WordPress Themify Themify Sidepane, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide permite cargar un Web Shell a un servidor web. Este problema afecta al tema de WordPress Themify Sidepane: desde n/d hasta 1.9.8; Themify Newsy: desde n/d hasta 1.9.9; Themify Folo: desde n/d hasta 1.9.6; Themify Edmin: desde n/d hasta 2.0.0; Bloggie: desde n/d hasta 2.0.8; Photobox: desde n/d hasta 2.0.1; Wigi: desde n/d hasta 2.0.1; Rezo: desde n/d hasta 1.9.7; Slide: desde n/d hasta 1.7.5."}], "id": "CVE-2025-30996", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30996", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T21:04:53.034028Z", "version": "2.0.3"}}]}, "published": "2026-01-06T21:15:42.560", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/bloggie/vulnerability/wordpress-bloggie-2-0-8-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/edmin/vulnerability/wordpress-themify-edmin-2-0-0-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/folo/vulnerability/wordpress-themify-folo-1-9-6-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/photobox/vulnerability/wordpress-photobox-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/rezo/vulnerability/wordpress-rezo-1-9-7-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/sidepane/vulnerability/wordpress-themify-sidepane-wordpress-theme-1-9-8-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/slide/vulnerability/wordpress-slide-1-7-5-arbitrary-file-upload-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/wigi/vulnerability/wordpress-wigi-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"created": "2026-01-07T10:08:17.313363+00:00", "updated": "2026-05-01T06:00:13.578865+00:00", "vendors": ["themify", "themify$PRODUCT$bloggie", "themify$PRODUCT$edmin", "themify$PRODUCT$folo", "themify$PRODUCT$newsy", "themify$PRODUCT$photobox", "themify$PRODUCT$rezo", "themify$PRODUCT$sidepane_wordpress_theme", "themify$PRODUCT$slide", "themify$PRODUCT$wigi", "wordpress", "wordpress$PRODUCT$wordpress"]}