G5theme vulnerabilities

🔔 Create alert RSS

Published CVEs affecting G5theme products: 11 record(s), with severity, exploitation and fixes.

Zorka 2 Essential Real Estate 2 Handmade Framework 2 Wolverine Framework 1 Darna Framework 1 G5Plus April 1 Book Previewer for Woocommerce 1 Grid Plus 1

Exploited only (KEV) →

CVE-2026-39714 Medium · 5.3 CWE-862 Apr 8, 2026

WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

CVE-2026-39668 Medium · 5.3 CWE-862 Apr 8, 2026

WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.

CVE-2026-27088 High · 7.1 CWE-79 Mar 25, 2026

WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2.9.

CVE-2026-27087 High · 7.1 CWE-79 Mar 25, 2026

WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.

CVE-2026-22520 High · 7.1 CWE-79 Mar 25, 2026

WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.

CVE-2025-69096 High · 7.1 CWE-79 Mar 25, 2026

WordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zorka: from n/a through <= 1.5.7.

CVE-2026-22521 High · 7.5 CWE-98 Jan 8, 2026

WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Local File Inclusion.This issue affects Handmade Framework: from n/a through <= 3.9.

CVE-2026-0676 Medium · 5.3 CWE-862 Jan 8, 2026

WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5.7.

CVE-2025-68071 Medium · 6.5 CWE-639 Dec 16, 2025

WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

CVE-2025-66127 Medium · 5.3 CWE-862 Dec 16, 2025

WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

CVE-2025-53352 High · 7.1 CWE-79 Oct 22, 2025

WordPress Grid Plus plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Grid Plus grid-plus allows Reflected XSS.This issue affects Grid Plus: from n/a through <= 3.3.