Liquidthemes vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Liquidthemes products: 5 record(s), with severity, exploitation and fixes.

AI Engine for WordPress: ChatGPT, GPT Content Generator 1 Hub Core 1 MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator 1 Booking Hub 1 Ave Core 1

Exploited only (KEV) →

CVE-2026-32561 High · 8.8 CWE-266 Aug 24, 2026

WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

CVE-2026-32560 High · 8.8 CWE-98 Aug 24, 2026

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.

CVE-2026-25460 Medium · 6.3 CWE-862 Mar 25, 2026

WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through <= 2.9.1.

CVE-2025-68065 High · 7.5 CWE-98 Dec 16, 2025

WordPress Hub Core plugin < 6.0.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion. This issue affects Hub Core: from n/a before 6.0.2.

CVE-2025-13380 Medium · 6.5 CWE-73 Nov 25, 2025

AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.