Radiustheme vulnerabilities
62 vulnerabilities
Known vulnerabilities in Radiustheme products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 25 products.
Products
25- Classified Listing17 vulnerabilities
- The Post Grid12 vulnerabilities
- Radius Blocks4 vulnerabilities
- Review Schema3 vulnerabilities
- Shopbuilder – Elementor Woocommerce Builder Addons3 vulnerabilities
- Team3 vulnerabilities
- Testimonial Slider And Showcase3 vulnerabilities
- Metro2 vulnerabilities
- Team Wordpress Team Members Showcase2 vulnerabilities
- Testimonial Slider And Showcase Pro2 vulnerabilities
- Widget For Google Reviews2 vulnerabilities
- Classified Listing Mobile Number Verification1 vulnerabilities
- Classified Listing Store \& Membership1 vulnerabilities
- Classima1 vulnerabilities
- Classima Core1 vulnerabilities
- Food Menu – Restaurant Menu & Online Ordering For Woocommerce1 vulnerabilities
- Homlisti1 vulnerabilities
- Logo Slider And Showcase1 vulnerabilities
- Medilink Core1 vulnerabilities
- Portfolio1 vulnerabilities
- Portfolio – Wordpress Portfolio Plugin1 vulnerabilities
- Radius Booking — Booking Calendar For Appointments &Amp; Services1 vulnerabilities
- Shopbuilder1 vulnerabilities
- Variation Images Gallery For Woocommerce1 vulnerabilities
- Variation Swatches For Woocommerce1 vulnerabilities
MediumCVE-2021-24742radiustheme · logo_slider_and_showcase +2 moreLogo Slider and Showcase < 1.3.37 - Editor Plugin's Settings UpdateThe Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.EPSS0.86%MediumCVE-2025-54698radiustheme · classified_listing +1 moreWordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection VulnerabilityImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing classified-listing allows Code Injection.This issue affects Classified Listing: from n/a through <= 5.0.0.EPSS0.19%HighCVE-2025-52715radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 4.2.0 - Local File Inclusion VulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 4.2.0.EPSS0.56%MediumCVE-2025-1063radiustheme · classified_listing +2 moreClassified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings ExposureThe Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.EPSS0.36%HighCVE-2025-7327radiustheme · widget_for_google_reviews +2 moreWidget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File InclusionThe Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.EPSS0.78%HighCVE-2025-53565radiustheme · widget_for_google_reviews +1 moreWordPress Widget for Google Reviews <= 1.0.15 - Local File Inclusion VulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews business-reviews-wp allows PHP Local File Inclusion.This issue affects Widget for Google Reviews: from n/a through <= 1.0.15.EPSS0.56%MediumCVE-2025-58601radiustheme · classified_listing +1 moreWordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control VulnerabilityMissing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.EPSS0.24%MediumCVE-2025-57975radiustheme · team +1 moreWordPress Team Plugin <= 5.0.6 - Broken Access Control VulnerabilityMissing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.6.EPSS0.27%MediumCVE-2025-24712radiustheme · radius blocks +1 moreWordPress Radius Blocks – WordPress Gutenberg Blocks Plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Radius Blocks radius-blocks allows Cross Site Request Forgery.This issue affects Radius Blocks: from n/a through <= 2.1.2.EPSS0.21%HighCVE-2025-24745radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Classified Listing classified-listing allows Reflected XSS.This issue affects Classified Listing: from n/a through <= 4.0.1.EPSS0.29%MediumCVE-2025-64282radiustheme · radius blocks +1 moreWordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Blocks: from n/a through <= 2.2.1.EPSS0.21%CriticalCVE-2025-32656radiustheme · testimonial slider and showcase pro +1 moreWordPress Testimonial Slider and Showcase Pro plugin <= 2.3.15 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.3.15.EPSS0.94%HighCVE-2025-32159radiustheme · radius blocks +1 moreWordPress Radius Blocks plugin <= 2.2.1 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Radius Blocks radius-blocks allows PHP Local File Inclusion.This issue affects Radius Blocks: from n/a through <= 2.2.1.EPSS1.00%HighCVE-2025-32657radiustheme · testimonial slider and showcase pro +1 moreWordPress Testimonial Slider and Showcase Pro plugin <= 2.1.7 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.1.7.EPSS0.61%HighCVE-2025-30814radiustheme · the_post_grid +1 moreWordPress The Post Grid plugin <= 7.7.17 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid the-post-grid allows PHP Local File Inclusion.This issue affects The Post Grid: from n/a through <= 7.7.17.EPSS1.11%MediumCVE-2022-2654radiustheme · classified_listing +13 moreClassima < 2.1.11 - Reflected Cross-Site ScriptingThe Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site ScriptingEPSS0.62%HighCVE-2022-2557radiustheme · team_-_wordpress_team_members_showcase +2 moreWordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and DeletionThe Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the userEPSS1.65%MediumCVE-2022-2655radiustheme · classified_listing +2 moreClassified Listing Pro < 2.0.20 - Reflected Cross-Site ScriptingThe Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site ScriptingEPSS0.70%HighCVE-2022-46853radiustheme · the_post_grid +1 moreWordPress The Post Grid Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.EPSS0.26%MediumCVE-2022-50947radiustheme · testimonial_slider_and_showcaseWordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSSAttackers with editor privileges can inject JavaScript payloads through the testimonial title field that execute in the browsers of users viewing the draft post, enabling cookie theft and session hijacking.EPSS0.20%