Skip to content
OpenAdvisories

Vendor

Themeton

22 known vulnerabilities.

Themeton at a glance

Last 12 months
5
Critical · all time
14
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability, 1 critical February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities, 2 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities, 2 critical Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202622
May 202600
Apr 202600
Mar 202622
Feb 202600
Jan 202611
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202575
May 2025104
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Spare 3 Acerola 2 Seven Stars 2 The Business 2 HotStar – Multi-Purpose Business Theme 2 The Fashion - Model Agency One Page Beauty Theme 1 The Barber Shop 1 Rozario 1 Consult Aid 1 PressGrid - Frontend Publish Reaction & Multimedia Theme 1 FLAP - Business WordPress Theme 1 Zuut 1 Finag 1 Lagom 1 PIMP - Creative MultiPurpose 1 Dash 1
All Critical High Medium Low Exploited only Public exploit

22 results · Feed

  • Critical 9.8
    CVE-2025-60230

    WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.

    Themeton The Barber Shop
  • Critical 9.8
    CVE-2025-60229

    WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.

    Themeton Lagom
  • Critical 9.8
    CVE-2025-60237

    WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.

    Themeton Finag
  • Critical 9.8
    CVE-2025-60233

    WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.

    Themeton Zuut
  • Critical 9.8
    CVE-2025-67617

    WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

    Themeton Consult Aid
  • High 7.1
    CVE-2025-31067

    WordPress Seven Stars theme <= 1.4.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Seven Stars allows Stored XSS. This issue affects Seven Stars: from n/a through 1.4.4.

    Themeton Seven Stars
  • Critical 9.8
    CVE-2025-31919

    WordPress Spare <= 1.7 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.

    Themeton Spare
  • Critical 9.8
    CVE-2025-31052

    WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/a through <= 1.4.4.

    Themeton The Fashion - Model Agency One Page Beauty Theme
  • Critical 9.8
    CVE-2025-31396

    WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5.

    Themeton FLAP - Business WordPress Theme Web / CMS
  • Critical 9.8
    CVE-2025-31398

    WordPress PIMP - Creative MultiPurpose <= 1.7 - Deserialization of untrusted data Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.

    Themeton PIMP - Creative MultiPurpose
  • Critical 9.8
    CVE-2025-31429

    WordPress PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.

    Themeton PressGrid - Frontend Publish Reaction & Multimedia Theme
  • High 7.1
    CVE-2025-31638

    WordPress Spare <= 1.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7.

    Themeton Spare
  • Critical 9.8
    CVE-2025-31049

    WordPress Dash <= 1.3 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.

    Themeton Dash
  • Critical 9.8
    CVE-2025-31069

    WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.

    Themeton HotStar – Multi-Purpose Business Theme
  • Critical 9.8
    CVE-2025-31430

    WordPress The Business <= 1.6.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.

    Themeton The Business
  • Critical 9.8
    CVE-2025-31927

    WordPress Acerola <= 1.6.5 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.

    Themeton Acerola
  • Medium 5.3
    CVE-2025-31065

    WordPress Rozario <= 1.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4.

    Themeton Rozario
  • Medium 5.3
    CVE-2025-31066

    WordPress Acerola theme <= 1.6.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.

    Themeton Acerola
  • Medium 4.3
    CVE-2025-31068

    WordPress Seven Stars <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4.4.

    Themeton Seven Stars
  • Medium 5.3
    CVE-2025-31630

    WordPress The Business <= 1.6.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Business: from n/a through 1.6.1.

    Themeton The Business
  • Medium 5.3
    CVE-2025-31071

    WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.

    Themeton HotStar – Multi-Purpose Business Theme
  • Medium 4.3
    CVE-2025-31639

    WordPress Spare <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7.

    Themeton Spare