Vendor
Aonetheme
11 known vulnerabilities.
Aonetheme at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 2 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 2 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 2 | 1 |
| Aug 2025 | 2 | 2 |
| Jul 2025 | 1 | 1 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 1 |
| Mar 2025 | 1 | 1 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
11 results · Feed
-
High 8.8
WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
-
Medium 6.5
WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
-
High 8.8
Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like ema…
-
High 8.8
Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change re…
-
Critical 9.8
Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using …
-
High 8.1
Service Finder SMS System <= 2.0.0 - Authentication Bypass
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthentic…
-
Critical 9.8
Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in throug…
-
Critical 9.8
Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation
The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the ao…
-
Critical 9.8
WordPress Service Finder Booking plugin <= 6.1 - Privilege Escalation Vulnerability
Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through <= 6.1.
-
Critical 9.8
Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'
The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the '…
-
Critical 9.8
Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is due to the plugin not properly validating a user's identity prior to (1) performing a post-booking a…