Skip to content
OpenAdvisories

Vendor

LoftOcean

9 known vulnerabilities.

Products

CozyStay 4 PatioTime 2 CozyStay - Hotel Booking WordPress Theme 2 TinySalt 1 TinySalt - Personal Food Blog WordPress Theme 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-78289

    WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

    LoftOcean CozyStay
  • High 8.1
    CVE-2025-67992

    WordPress PatioTime theme < 2.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean PatioTime patiotime allows PHP Local File Inclusion.This issue affects PatioTime: from n/a through < 2.1.

    LoftOcean PatioTime
  • High 8.1
    CVE-2025-67988

    WordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.9.1.

    LoftOcean CozyStay
  • High 8.1
    CVE-2025-49508

    WordPress CozyStay theme < 1.7.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1.

    LoftOcean CozyStay
  • High 8.1
    CVE-2025-49454

    WordPress TinySalt theme < 3.10.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a through < 3.10.0.

    LoftOcean TinySalt
  • High 7.5
    CVE-2024-13412

    CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler

    The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to execute arb…

    LoftOcean CozyStay - Hotel Booking WordPress Theme Web / CMS