BuddhaThemes vulnerabilities
Published CVEs affecting BuddhaThemes products: 6 record(s), with severity, exploitation and fixes.
WeDesignTech Ultimate Booking Addon 2Neo | Barber Shop WordPress Theme 1ColorFolio 1ColorFolio - Freelance Designer WordPress Theme 1Lizza LMS Pro 1
CVE-2026-94065
High · 8.8
CWE-502 Oct 9, 2026
WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
CVE-2026-94064
High · 8.8
CWE-502 Oct 9, 2026
WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
CVE-2026-27096
High · 8.1
CWE-502 Mar 19, 2026
WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
CVE-2025-69340
High · 7.5
CWE-862 Mar 5, 2026
WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
CVE-2025-13563
Critical · 9.8
CWE-269 Feb 19, 2026
Lizza LMS Pro for WordPress - Privilege Escalation via Unrestricted User Role Registration
The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVE-2025-69341
Medium · 5.4
CWE-862 Jan 6, 2026
WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.