Vowelweb vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Vowelweb products: 10 record(s), with severity, exploitation and fixes.

Ibtana – WordPress Website Builder 2 VW Fitness 1 VW Pet Shop 1 VW Photography 1 VW Portfolio 1 VW School Education 1 VW Education Lite 1 VW Food Corner 1 VW Wedding 1

Exploited only (KEV) →

CVE-2026-57776 Medium · 5.3 CWE-862 Jul 13, 2026

WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.

CVE-2026-57774 Medium · 5.3 CWE-862 Jul 13, 2026

WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.

CVE-2026-1834 Medium · 6.4 CWE-80 Mar 31, 2026

Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to, and including, 1.2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-32438 Medium · 5.3 CWE-862 Mar 13, 2026

WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.

CVE-2026-32437 Medium · 5.3 CWE-862 Mar 13, 2026

WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.

CVE-2026-32436 Medium · 5.3 CWE-862 Mar 13, 2026

WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.

CVE-2026-32435 Medium · 5.3 CWE-862 Mar 13, 2026

WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.

CVE-2026-32434 Medium · 5.3 CWE-862 Mar 13, 2026

WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.

CVE-2026-32427 Medium · 5.3 CWE-862 Mar 13, 2026

WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.

CVE-2025-5092 Medium · 6.4 CWE-79 Nov 20, 2025

Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.