Vulnerabilidades de BuddhaThemes
CVEs publicadas que afetam produtos de BuddhaThemes: 6 registro(s), com severidade, exploração e correções.
WeDesignTech Ultimate Booking Addon 2Neo | Barber Shop WordPress Theme 1ColorFolio 1ColorFolio - Freelance Designer WordPress Theme 1Lizza LMS Pro 1
CVE-2026-94065
Alta · 8.8
CWE-502 09/10/2026
WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
CVE-2026-94064
Alta · 8.8
CWE-502 09/10/2026
WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
CVE-2026-27096
Alta · 8.1
CWE-502 19/03/2026
WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
CVE-2025-69340
Alta · 7.5
CWE-862 05/03/2026
WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
CVE-2025-13563
Crítica · 9.8
CWE-269 19/02/2026
Lizza LMS Pro para WordPress - Escalonamento de Privilégios por Registro com Função Irrestrita
O plugin Lizza LMS Pro para WordPress é vulnerável a Escalonamento de Privilégios em todas as versões até a 1.0.3, inclusive. Isso se deve à função 'lizza_lms_pro_register_user_front_end', que não restringe quais funções de usuário podem ser atribuídas durante o registro. Isso torna possível que atacantes não autenticados informem a função 'administrator' no registro e obtenham acesso de administrador ao site.
CVE-2025-69341
Média · 5.4
CWE-862 06/01/2026
WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.