Themepassion vulnerabilities
Published CVEs affecting Themepassion products: 4 record(s), with severity, exploitation and fixes.
CVE-2025-69179
Critical · 9.8
CWE-266 Jun 17, 2026
WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
CVE-2026-22524
High · 7.1
CWE-79 Mar 25, 2026
WordPress Legacy Admin plugin <= 9.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Legacy Admin legacy-admin allows Reflected XSS.This issue affects Legacy Admin: from n/a through <= 9.5.
CVE-2026-22523
High · 7.1
CWE-79 Mar 25, 2026
WordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra WordPress Admin ultra-admin allows Reflected XSS.This issue affects Ultra WordPress Admin: from n/a through <= 11.7.
CVE-2025-69180
High · 8.5
CWE-89 Jan 22, 2026
WordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7.