Radiustheme vulnerabilities, page 3
62 vulnerabilities
Known vulnerabilities in Radiustheme products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 25 products.
CriticalCVE-2026-39764radiustheme · radius booking — booking calendar for appointments & services +1 moreWordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerabilityUnauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.EPSS0.30%HighCVE-2026-25026radiustheme · team +1 moreWordPress Team plugin <= 5.0.11 - Broken Access Control vulnerabilityMissing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.EPSS0.29%MediumCVE-2026-25344radiustheme · review_schema +1 moreWordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.EPSS0.28%MediumCVE-2026-66647radiustheme · homlisti +1 moreWordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerabilitySubscriber Broken Access Control in Homlisti <= 3.1.2 versions.EPSS0.30%HighCVE-2026-27382radiustheme · metro +1 moreWordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.EPSS0.27%HighCVE-2026-27383radiustheme · metro +1 moreWordPress Metro theme <= 2.13 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through <= 2.13.EPSS0.59%MediumCVE-2026-57355radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerabilitySubscriber Broken Access Control in Classified Listing <= 5.4.2 versions.EPSS0.30%HighCVE-2026-57344radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.EPSS0.25%MediumCVE-2026-94671radiustheme · the_post_grid +1 moreWordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerabilityContributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.EPSS0.17%MediumCVE-2026-94680radiustheme · the_post_grid +1 moreWordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerabilityContributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.EPSS0.17%HighCVE-2026-15985radiustheme · classified listing - mobile number verification +1 moreClassified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP LoginThe Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.EPSS0.33%HighCVE-2026-96351radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.EPSS0.18%MediumCVE-2026-32396radiustheme · team +1 moreWordPress Team plugin <= 5.0.13 - Broken Access Control vulnerabilityMissing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.EPSS0.27%MediumCVE-2026-32372radiustheme · shopbuilder – elementor woocommerce builder addons +1 moreWordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.EPSS0.34%HighCVE-2026-32369radiustheme · medilink-core +1 moreWordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Medilink-Core medilink-core allows PHP Local File Inclusion.This issue affects Medilink-Core: from n/a through < 2.0.7.EPSS0.53%MediumCVE-2026-97282radiustheme · review_schema +1 moreWordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerabilityUnauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.EPSS0.18%MediumCVE-2026-23546radiustheme · classified_listing +1 moreWordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.This issue affects Classified Listing: from n/a through <= 5.3.4.EPSS0.38%HighCVE-2023-39923radiustheme · the_post_grid +1 moreWordPress The Post Grid Plugin <= 7.2.7 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions.EPSS0.25%HighCVE-2023-37387radiustheme · classified_listing +1 moreWordPress Classified Listing Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.EPSS0.25%HighCVE-2023-37894radiustheme · variation_images_gallery_for_woocommerce +1 moreWordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RadiusTheme Variation Images Gallery for WooCommerce plugin <= 2.3.3 versions.EPSS0.38%