CVE Intelligence

ApusTheme vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ApusTheme products: 9 record(s), with severity, exploitation and fixes.

Drone 1Homeo 1WP Freeio 1ITok 1Freeio 1Greenorganic 1WP CarDealer 1Findgo 1Famita 1

Exploited only (KEV) →

CVE-2026-39681 High · 7.5 CWE-98 Apr 8, 2026
WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.
CVE-2026-39679 High · 7.5 CWE-98 Apr 8, 2026
WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.
CVE-2025-49249 High · 7.1 CWE-79 Jan 22, 2026
WordPress Drone theme <= 1.40 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Drone drone allows Reflected XSS.This issue affects Drone: from n/a through <= 1.40.
CVE-2025-53437 High · 8.1 CWE-98 Dec 18, 2025
WordPress Greenorganic theme <= 2.45 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Greenorganic greenorganic allows PHP Local File Inclusion.This issue affects Greenorganic: from n/a through <= 2.45.
CVE-2025-13764 Critical · 9.8 CWE-269 Dec 11, 2025
WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVE-2025-62014 High · 8.1 CWE-98 Nov 6, 2025
WordPress ITok theme <= 1.1.42 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.This issue affects ITok: from n/a through <= 1.1.42.
CVE-2025-62010 High · 8.1 CWE-98 Nov 6, 2025
WordPress Famita theme <= 1.54 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Local File Inclusion.This issue affects Famita: from n/a through <= 1.54.
CVE-2025-11533 Critical · 9.8 CWE-269 Oct 11, 2025
WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation
The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVE-2025-58250 High · 8.8 CWE-352 Sep 22, 2025
WordPress Findgo Theme <= 1.3.55 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo fingo allows Authentication Bypass.This issue affects Findgo: from n/a through <= 1.3.55.