Skip to content
OpenAdvisories

Vendor

ThemeMove

31 known vulnerabilities.

ThemeMove at a glance

Last 12 months
14
Critical · all time
3
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 3 vulnerabilities Dec 2025 January 2026: 4 vulnerabilities February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 4 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202640
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202610
Jan 202640
Dec 202530
Nov 202500
Oct 202561
Sep 202530
Aug 202520
Jul 202510
Jun 202511
May 202520
Apr 202510
Mar 202511
Feb 202500
Jan 202500
Dec 202400

Products

EduMall 4 Unicamp 3 Billey 2 Makeaholic 2 MinimogWP 2 MinimogWP – The High Converting eCommerce WordPress Theme 2 Brook 2 MaxCoach 1 SmilePure 1 Moody 1 Healsoul 1 Medizin 1 Amely 1 Businext 1 EduMall - Professional LMS Education Center WordPress Theme 1 AeroLand 1 ThemeMove Core 1 Mitech 1 Learts Addons 1 Atomlab 1 QuickCal - Appointment Booking Calendar for WordPress 1
All Critical High Medium Low Exploited only Public exploit

31 results · Feed

  • High 7.1
    CVE-2026-39748

    WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

    ThemeMove EduMall
  • Medium 4.3
    CVE-2026-57797

    WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.

    ThemeMove EduMall
  • High 7.5
    CVE-2026-57791

    WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

    ThemeMove Brook
  • High 7.5
    CVE-2026-57790

    WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.

    ThemeMove Billey
  • High 8.5
    CVE-2025-69094

    WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability

    Subscriber SQL Injection in Unicamp <= 2.2.2 versions.

    ThemeMove Unicamp
  • High 8.1
    CVE-2026-39590

    WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

    ThemeMove Atomlab
  • High 7.5
    CVE-2026-25027

    WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.7.1.

    ThemeMove Unicamp
  • High 8.1
    CVE-2025-22707

    WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3.

    ThemeMove Moody
  • High 8.1
    CVE-2025-22708

    WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.

    ThemeMove Mitech
  • High 8.1
    CVE-2025-14430

    WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

    ThemeMove Brook
  • High 8.1
    CVE-2025-14429

    WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through <= 1.6.6.

    ThemeMove AeroLand
  • High 8.1
    CVE-2025-60069

    WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

    ThemeMove MinimogWP
  • High 7.5
    CVE-2025-68062

    WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

    ThemeMove MinimogWP
  • High 7.5
    CVE-2025-68061

    WordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.

    ThemeMove EduMall
  • High 8.1
    CVE-2025-59564

    WordPress EduMall Theme < 4.4.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.

    ThemeMove EduMall
  • High 8.1
    CVE-2025-59558

    WordPress Billey Theme < 2.1.6 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.

    ThemeMove Billey
  • Critical 9.3
    CVE-2025-59557

    WordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.

    ThemeMove Learts Addons
  • High 8.1
    CVE-2025-59555

    WordPress Medizin Theme < 1.9.7 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.

    ThemeMove Medizin
  • High 8.1
    CVE-2025-58967

    WordPress Businext theme < 2.4.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP Local File Inclusion.This issue affects Businext: from n/a through < 2.4.4.

    ThemeMove Businext
  • High 8.1
    CVE-2025-58958

    WordPress SmilePure Theme < 1.8.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/a through < 1.8.5.

    ThemeMove SmilePure
  • High 8.8
    CVE-2025-53303

    WordPress ThemeMove Core Plugin <= 1.4.2 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.

    ThemeMove ThemeMove Core
  • High 8.1
    CVE-2025-58206

    WordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a through <= 3.2.5.

    ThemeMove MaxCoach
  • Medium 5.3
    CVE-2025-58210

    WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.

    ThemeMove Makeaholic
  • High 8.1
    CVE-2025-54701

    WordPress Unicamp Theme <= 2.6.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.6.3.

    ThemeMove Unicamp
  • High 8.1
    CVE-2025-54700

    WordPress Makeaholic Theme <= 1.8.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic makeaholic allows PHP Local File Inclusion.This issue affects Makeaholic: from n/a through <= 1.8.4.

    ThemeMove Makeaholic
  • High 7.5
    CVE-2025-8198

    MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation

    The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quantities in the cart. Th…

    ThemeMove MinimogWP – The High Converting eCommerce WordPress Theme Web / CMS
  • Critical 9.3
    CVE-2025-39474

    WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely amely allows SQL Injection.This issue affects Amely: from n/a through <= 3.1.4.

    ThemeMove Amely
  • High 8.1
    CVE-2025-32309

    WordPress Healsoul theme <= 2.2.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul healsoul allows PHP Local File Inclusion.This issue affects Healsoul: from n/a through <= 2.2.3.

    ThemeMove Healsoul
  • High 8.8
    CVE-2025-32310

    WordPress QuickCal plugin <= 1.0.15 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.

    ThemeMove QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • High 8.1
    CVE-2025-2101

    Edumall <= 4.2.4 - Unauthenticated Local File Inclusion

    The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and…

    ThemeMove EduMall - Professional LMS Education Center WordPress Theme Web / CMS
  • Critical 9.8
    CVE-2024-13790

    MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion

    The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.7.0 via the 'template' parameter. This makes it possible for unauthenticated attackers to include a…

    ThemeMove MinimogWP – The High Converting eCommerce WordPress Theme Web / CMS