Ashe Vulnerabilities

The Ashe theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.267. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.267

Fixed in:

2.268

Disclosed:

Feb 12, 2026

CVE-2026-39627 on NVD →

The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success...

CVSS:

6.1

Affected:

up to 2.243

Fixed in:

2.244

Disclosed:

Nov 18, 2024

CVE-2024-9777 on NVD →

The Ashe theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.233. This is due to missing or incorrect nonce validation on the ashe_activation_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can t...

CVSS:

4.3

Affected:

up to 2.233

Fixed in:

2.234

Disclosed:

Jul 1, 2024

CVE-2024-37478 on NVD →