Filtered by vendor Scriptsbundle Subscriptions

Search

Switch to Advanced Search (Beta)
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-11349 2 Scriptsbundle, Wordpress 2 Adforest, Wordpress 2025-08-12 9.8 Critical
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
CVE-2024-11350 2 Scriptsbundle, Wordpress 2 Adforest, Wordpress 2025-08-12 9.8 Critical
The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVE-2024-12855 2 Scriptsbundle, Wordpress 2 Adforest, Wordpress 2025-08-12 4.3 Medium
The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete posts, attachments and deactivate a license.
CVE-2019-15870 1 Scriptsbundle 1 Carspot 2025-03-20 N/A
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
CVE-2025-0169 1 Scriptsbundle 1 Dwt Listing 2025-02-12 6.4 Medium
The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-12857 1 Scriptsbundle 1 Adforest 2025-02-12 9.8 Critical
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.