Vulnerabilidades de Liquidthemes
CVEs publicadas que afetam produtos de Liquidthemes: 5 registro(s), com severidade, exploração e correções.
AI Engine for WordPress: ChatGPT, GPT Content Generator 1Hub Core 1MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator 1Booking Hub 1Ave Core 1
CVE-2026-32561
Alta · 8.8
CWE-266 24/08/2026
WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.
CVE-2026-32560
Alta · 8.8
CWE-98 24/08/2026
WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
CVE-2026-25460
Média · 6.3
CWE-862 25/03/2026
WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through <= 2.9.1.
CVE-2025-68065
Alta · 7.5
CWE-98 16/12/2025
WordPress Hub Core plugin < 6.0.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion.
This issue affects Hub Core: from n/a before 6.0.2.
CVE-2025-13380
Média · 6.5
CWE-73 25/11/2025
AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read
The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.