This page aggregates publicly disclosed CVE and security risk information related to uxper, with CVSS, EPSS, publication dates, and vulnerability intelligence data to help assess potential risk and remediation priority.
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-13773 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys. | [email protected] | 7.3 | 0.08% | 2025-03-14 | 2025-03-27 |
| CVE-2024-13772 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email. | [email protected] | 5.6 | 0.01% | 2025-03-14 | 2025-06-17 |
| CVE-2024-13771 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim. | [email protected] | 9.8 | 0.02% | 2025-03-14 | 2026-04-08 |
| CVE-2024-12876 | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.10. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. | [email protected] | 9.8 | 0.34% | 2025-03-07 | 2025-03-13 |
| CVE-2020-23790 | An Arbitrary File Upload vulnerability was discovered in the Golo Laravel theme v 1.1.5. | [email protected] | 9.8 | 0.43% | 2021-05-12 | 2024-11-21 |